4 ms·

That's not accurate. OpenSSH (and OpenBSD) have a myth around it about lack of security vulnerabilities, but while better than the average, it's wildly exaggera

That's not accurate. OpenSSH (and OpenBSD) have a myth around it about lack of security vulnerabilities, but while better than the average, it's wildly exaggerated: Reference: https://www.cvedetails.com/vulnerability-list.php?vendor_id=97&product_id=585&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=97&sha=cf091948bd7a20cd650cfc7fb718a5f4400a6d71 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... I remember people in the '90s and '00s being smug about still being on ssh.com, because something like 75% of vulnerabilities in SSH implementations for a long time were introduced only into OpenSSH.

yjftsjthsd-h 4y ago
Actually reading down those vulnerabilities makes me as confident as ever in it; it has a steady stream of vulnerabilities, but they're almost always things like user enumeration, or a person who already has legitimate access being able to get slightly different access than they were supposed to have. Don't get me wrong, those are still bad, but if you have to go back 20 years to find an actual remote access vulnerability, then I'd say the software is rock solid.
- knorker 4y ago
  I don't disagree. SSH was already 25 years ago a mature code base with (more importantly) a limited scope and unchanging core requirements. I think its long life and limited scope is more of a factor to its security success than how good the coders were. Once you get out of the simple case of "RCE on pre-auth sshd" OpenSSH is no longer looking as good. E.g. CVE-2019-611 is way underhyped, and the fact that it was only discovered in 2019 doesn't speak well for OpenSSH's audit process. But for "is it safe to open OpenSSH to the world" I'd say "that's safer than anything else, sure". But that's a very narrow (though important) attack vector.

yjftsjthsd-h 4y ago

Actually reading down those vulnerabilities makes me as confident as ever in it; it has a steady stream of vulnerabilities, but they're almost always things like user enumeration, or a person who already has legitimate access being able to get slightly different access than they were supposed to have. Don't get me wrong, those are still bad, but if you have to go back 20 years to find an actual remote access vulnerability, then I'd say the software is rock solid.

knorker 4y ago
I don't disagree. SSH was already 25 years ago a mature code base with (more importantly) a limited scope and unchanging core requirements. I think its long life and limited scope is more of a factor to its security success than how good the coders were. Once you get out of the simple case of "RCE on pre-auth sshd" OpenSSH is no longer looking as good. E.g. CVE-2019-611 is way underhyped, and the fact that it was only discovered in 2019 doesn't speak well for OpenSSH's audit process. But for "is it safe to open OpenSSH to the world" I'd say "that's safer than anything else, sure". But that's a very narrow (though important) attack vector.