Hacker News Reader

Comment by ddevault | Hacker News Reader

Note that libssh != openssh, which is what's probably running on your server.

I had a semi heartattack for a second until I realized that

I tried to find what it is used in. The site claims that it's used server-side by GitHub: https://www.libssh.org/#text-5

GitHub says that the way they're using libssh isn't affected. They apparently use in-house code for the authentication.

https://twitter.com/GitHubSecurity/status/105231733337972326...

    $ apt-cache rdepends libssh-4
    libssh-4
    Reverse Depends:
      libpam-x2go
      yafc
      x2goclient
      tmate
      remmina-plugin-nx
      remmina
      openvas-nasl
      libopenvas9
      libssh-dev
      cockpit-bridge
      kio-extras
      hydra

This is all of the packages that depend on libssh in Debian Testing, doesn't seem to be very problematic, I've only heard of one thing on this list, and that doesn't use the server code anyways.

Tmate might have issues...there's both client and server code.

Nice command. Cockpit-bridge has a very good name!

Dependents in Homebrew: Csync, Hydra, Sshtrix, Yafc.

[1] http://brewformulas.org/Libssh

For some reason that site doesn't seem to list all possibly reverse dependencies of libssh.

According to the brew uses command the possible dependents are ffmpeg, ffmpeg@2.8, hydra, sshtrix, tmate, wireshark, and yafc. I say possible because some of those can optionally depend upon libssh, but the user has to opt-in to building with libssh support.

Those are almost certainly all using the client functionality. I'm not sure what uses libssh as an ssh server. (Edit: it may be that there is no open source code in existence anywhere which uses libssh in this way, except maybe some sample code. See https://twitter.com/cryptomilk/status/1052286350379114496 )

Reply on news.ycombinator.com