[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <9c5ab4b0-4ddb-ca3d-85e2-d47f058f7f73@mindrot.org>
Date: Mon, 29 Sep 2025 12:44:33 +1000 (AEST)
From: Damien Miller <djm@...drot.org>
To: "Adiletta, Andrew" <ajadiletta@....edu>
cc: Theo de Raadt <deraadt@...nbsd.org>, Solar Designer <solar@...nwall.com>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"openssh@...nssh.com" <openssh@...nssh.com>,
"Tol, Caner" <mtol@....edu>, "Sunar, Berk" <sunar@....edu>,
"Doroz, Yarkin" <ydoroz@....edu>,
"Todd C. Miller" <Todd.Miller@...rtesan.com>,
"pgut001@...auckland.ac.nz" <pgut001@...auckland.ac.nz>
Subject: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in
OpenSSH
On Sun, 28 Sep 2025, Adiletta, Andrew wrote:
> Theo,
>
> Even after two years we stand behind our paper and the contributions
> as outlined. There is nothing more natural for any vulnerability
> researcher to evaluate the most widely used products. If we had doubts
> about the claim or any of the POCs, we would have simply not included
> them in the paper.
Again, the POCs were not against OpenSSH but your modified version and
you did not demonstrate any of the techniques that you suppose could
have been used to make the attack viable against the unmodified product.
Your abstract therefore clearly overstates the extent of your work.
The fact that someone filed this CVE based on your paper demonstrates
that it is misleading.
-d
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
