News for hackers. Stuff that matters.

A comment on OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup and Proof-of-Concept. Parent comment

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by riolu on Wednesday February 08, 2023 @03:19PM (#34714355)
That isn't even remotely related the post and Monterey is over a year old.

The systems you are trying to SSH to are using outdated host keys, you need to actually update to get security fixes, it will regenerate host keys.

You shouldn't be worried about this CVE, it sounds like you have quite a few years of CVE's you've neglected to patch anyways.

[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by josephcsible on Wednesday February 08, 2023 @03:40PM (#34714709)
> The systems you are trying to SSH to are using outdated host keys, you need to actually update to get security fixes, it will regenerate host keys.

No you don't. rsa-sha2-256 and rsa-sha2-512 are still enabled by default and can use the same key.

[ Parent | on HN ]
Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by obituary_latte on Thursday February 09, 2023 @08:44AM (#34723743)
The reason it triggered my question is they had to do something similar to get the exploit to work (add +ssh-rsa to putty). Thanks, though, for the thoughtful reply.
[ Parent | on HN ]