News for hackers. Stuff that matters.

A comment on OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup and Proof-of-Concept. Parent comment

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by uraid on Wednesday February 08, 2023 @02:34PM (#34713608)
This is exploitable in the latest Archlinux 2023.02.01. Also, this doesn't require enabling old key exchange algorithms.
[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by herpderperator on Wednesday February 08, 2023 @02:51PM (#34713862)
What does "the latest Arch Linux" mean? Arch Linux is a rolling distribution. It was patched in the repository on 2023-02-02[0].

[0] https://archlinux.org/packages/core/x86_64/openssh/

[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by saghm on Wednesday February 08, 2023 @05:05PM (#34716048)
I assume they mean the latest version available for download as an .iso, since I think that tends to happen around monthly. I agree that this isn't super concerning though, since even installing from that would result in an up-to-date system, and there isn't much reason to ssh to or from the live disk.
[ Parent | on HN ]