On 10/30/20 4:51 PM, Pawel Winogrodzki wrote:
Hello, We are currently trying to apply a patch to our 8.0p1 version of OpenSSH for CVE-2020-14145<https://nvd.nist.gov/vuln/detail/CVE-2020-14145>. The "patch" tag from NIST's web page links to the 8.3p1 vs 8.4p1 comparison<https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1> on GitHub. Is there, however, any one specific patch, which could be backported to our version or is updating to 8.4p1 the only solution for this CVE? Thank you in advance for your help!
There is no patch for that CVE (not even in openssh-8.4p1). It is by most considered as a usability feature rather than CVE.
Regards, -- Jakub Jelen Senior Software Engineer Crypto Team, Security Engineering Red Hat, Inc. _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
