Hacker News Reader

Comment by qhwudbebd | Hacker News Reader

This was present in versions 9.5 - 9.7 of OpenSSH and fixed in 9.8p1 released at the beginning of July. Philippos (along with others) is credited for reporting it in the release notes:

  https://www.openssh.com/releasenotes.html#9.8p1

View on HN

Worth noting too, that other linux systems using 8.9, e.g. ubuntu are 8.9p1 and have the patch applied but to an older version so they're also safe. Just in case anyone was worried about that.

I'd be very surprised if ubuntu has backported the keystroke obfuscation feature (which was introduced in 9.5) to 8.9.

When the feature is missing, you're not safe from keystroke interception at all, which is what this bug is all about, so any 8.9 version would be actually considered "unsafe" until the whole feature is backported, which seems unlikely to happen?

Reply on news.ycombinator.com