3 ms·
https://nvd.nist.gov/vuln/detail/CVE-2023-25136 https://nvd.nist.gov/vuln/detail/CVE-2023-25136 > OpenSSH server (sshd) 9.1 introduced https://security-tracke
by AdamJacobMuller 4y ago
https://nvd.nist.gov/vuln/detail/CVE-2023-25136 https://nvd.nist.gov/vuln/detail/CVE-2023-25136
> OpenSSH server (sshd) 9.1 introduced
https://security-tracker.debian.org/tracker/CVE-2023-25136 https://security-tracker.debian.org/tracker/CVE-2023-25136
Is this even exploitable in any distributed configuration, considering that it requires enabling old deprecated key exchange algorithms?
- detourdog 4y agoNeeded fixing regardless and is fixed in 9.2.
- uraid 4y agoThis is exploitable in the latest Archlinux 2023.02.01. Also, this doesn't require enabling old key exchange algorithms.
- herpderperator 4y agoWhat does "the latest Arch Linux" mean? Arch Linux is a rolling distribution. It was patched in the repository on 2023-02-02[0]. [0] https://archlinux.org/packages/core/x86_64/openssh/ https://archlinux.org/packages/core/x86_64/openssh/
- saghm 4y agoI assume they mean the latest version available for download as an .iso, since I think that tends to happen around monthly. I agree that this isn't super concerning though, since even installing from that would result in an up-to-date system, and there isn't much reason to ssh to or from the live disk.