3 ms·
This was present in versions 9.5 - 9.7 of OpenSSH and fixed in 9.8p1 released at the beginning of July. Philippos (along with others) is credited for reporting
by qhwudbebd 2y ago
This was present in versions 9.5 - 9.7 of OpenSSH and fixed in 9.8p1 released at the beginning of July. Philippos (along with others) is credited for reporting it in the release notes:
https://www.openssh.com/releasenotes.html#9.8p1
- palisade 2y agoWorth noting too, that other linux systems using 8.9, e.g. ubuntu are 8.9p1 and have the patch applied but to an older version so they're also safe. Just in case anyone was worried about that.
- 0x0 2y agoI'd be very surprised if ubuntu has backported the keystroke obfuscation feature (which was introduced in 9.5) to 8.9. When the feature is missing, you're not safe from keystroke interception at all, which is what this bug is all about, so any 8.9 version would be actually considered "unsafe" until the whole feature is backported, which seems unlikely to happen?