4 ms·
Only if the server side accepted a client certificate during the handshake, and then either that certificate had a trust path to a root CA trusted by the server
by NovemberWhiskey 4y ago
Only if the server side accepted a client certificate during the handshake, and then either that certificate had a trust path to a root CA trusted by the server OR the server was not performing trust path validation. I think it's pretty nichey.
- slt2021 4y agoI was not able to find whether openssh can be exploited with this CVE by presenting malicious client auth certificate. would be glad if someone could clarify whether openssh has this vulnerability?
- formerly_proven 4y agoOpenSSH doesn't support X.509 certificates.
- xorcist 4y agoNor does it call any SSL-related function. OpenSSH only links to OpenSSL for the cryptographic primitives. SSH and SSL are different protocols.