News for hackers. Stuff that matters.

A comment on OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup and Proof-of-Concept. Parent comment

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by speedgoose on Wednesday February 08, 2023 @02:35PM (#34713616)
I expose Teleport instead of OpenSSH and it's not Rust but Golang.
[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by outworlder on Wednesday February 08, 2023 @05:18PM (#34716266)
But OpenSSH is still in the picture, is it not?
[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by duskwuff on Wednesday February 08, 2023 @05:44PM (#34716639)
I'm not specifically familiar with Teleport, but Go has its own native SSH implementation which doesn't depend on OpenSSH:

https://pkg.go.dev/golang.org/x/crypto/ssh

[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by tptacek on Wednesday February 08, 2023 @05:45PM (#34716652)
Teleport replaces OpenSSH.
[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by outworlder on Wednesday February 08, 2023 @06:12PM (#34717002)
Only if you deploy a teleport node, no? AFAIK it's optional
[ Parent | on HN ]