-
Notifications
You must be signed in to change notification settings - Fork 397
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
release request (terrapin) #270
Comments
Not sure if I'll get the release made in the next week, otherwise it'll be after mid-January. Note that Terrapin doesn't reduce the security of Dropbear at all, it doesn't implement
|
For reference, this commit can be cherrypicked if desired With description in 66bc1fc Lines 12 to 23 in 66bc1fc
|
The reason why we considered
While it is true that not sending However, we do not consider this application of the Terrapin attack to have a significant impact. Instead, our main concern is the combination of Terrapin with implementation bugs, as seen in AsyncSSH. We evaluated only a handful of SSH implementations, where one already allowed for in-session man-in-the-middle attacks. Given the wide variety of SSH implementations, one can estimate with sufficient probability that other implementations face similar issues. |
Please make a release that includes the fix for the terrapin vulnerability, for easier packaging.
Thank you!
The text was updated successfully, but these errors were encountered: