News for hackers. Stuff that matters.

A comment on Terrapin Attack for prefix truncation in SSH. Parent comment

Re:Terrapin Attack for prefix truncation in SSH by justinclift on Monday December 18, 2023 @02:45PM (#38687209)
Seems like it'll be a case of "wait for updated ssh packages", potentially with some mitigation advice appearing in the next day or so.
[ Parent | on HN ]
Re:Terrapin Attack for prefix truncation in SSH by 1letterunixname on Tuesday December 19, 2023 @04:37AM (#38693621)
No. Mitigations were available for openssh before you wrote that comment. Follow the recommendations from ssh-audit (master version). [0]

For packages, openssh and openssh-portable 9.6 include the fix, but every vendor will need to backport if they maintain their own pile of patches against a particular version of -portable.

0. https://github.com/jtesta/ssh-audit

[ Parent | on HN ]
Re:Terrapin Attack for prefix truncation in SSH by justinclift on Tuesday December 19, 2023 @12:06PM (#38698232)
Thanks, hadn't come across ssh-audit before. Looks like a good tool. :)
[ Parent | on HN ]