FYI OpenSSH's sshd is not vulnerable, despite using OpenSSL. Back in 2002 and after a different ASN.1 bug, Markus Friedl observed that RSA verification used the

FYI OpenSSH's sshd is not vulnerable, despite using OpenSSL. Back in 2002 and after a different ASN.1 bug, Markus Friedl observed that RSA verification used the OpenSSL's full ASN.1 parser to parse PKCS#1 RSA signatures despite them having an almost entirely fixed format under the parameters used in the SSH protocol. He wrote a minimal RSA signature verification implementation that we've used ever since. This is the eighth bug that it has saved us from in the last ten years. Attack surface reduction works. Note, other parts of OpenSSH are vulnerable - specifically private key loading. So, if you allow untrusted users to supply private keys to ssh, ssh-add or ssh-keygen running in a privileged context, then you should patch this bug ASAP.