OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup and Proof-of-Concept

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by jbverschoor on Wednesday February 08, 2023 @04:08PM (#34715196)

I repeat, "Every time I see OpenSSL anywhere I get this instant anxiety."

[ Parent | on HN ]

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by wolf550e on Wednesday February 08, 2023 @04:40PM (#34715650)

What does your comment have to do with OpenSSH?

[ Parent | on HN ]

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by jbverschoor on Wednesday February 08, 2023 @05:14PM (#34716181)

OpenSSH, OpenSSL, same sort of new items.

[ Parent | on HN ]

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by IntelMiner on Wednesday February 08, 2023 @08:33PM (#34718534)

What? No

OpenSSH and OpenSSL are completely different projects run by completely different people

Hell, The OpenBSD folks had a "fun" time forking OpenSSL to create "LibreSSL" (before it was promptly ignored by the rest of the open source community unfortunately)

[ Parent | on HN ]

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by dtx1 on Wednesday February 08, 2023 @05:07PM (#34716083)

If seeing software somewhere causes you anxiety, perhaps you should talk to a psychologist to help you overcome that.

[ Parent | on HN ]

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by somat on Wednesday February 08, 2023 @06:24PM (#34717168)

Based on there respective track records I sometimes wish that shttp was a thing. http over ssh.

[ Parent | on HN ]

Re:OpenSSH Pre-Auth Double Free – CVE-2023-25136 – Writeup a... by cesarb on Thursday February 09, 2023 @12:50AM (#34720222)

> Based on there respective track records I sometimes wish that shttp was a thing.

Well, shttp was a thing: https://www.rfc-editor.org/rfc/rfc2660.html

[ Parent | on HN ]