oss-security - Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <69192.1759119005@cvs.openbsd.org>
Date: Sun, 28 Sep 2025 22:10:05 -0600
From: "Theo de Raadt" <deraadt@...nbsd.org>
To: Peter Gutmann <pgut001@...auckland.ac.nz>
cc: Damien Miller <djm@...drot.org>,
    "Adiletta,
    Andrew" <ajadiletta@....edu>,
    Solar Designer <solar@...nwall.com>,
    "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
    "openssh@...nssh.com" <openssh@...nssh.com>,
    "Tol,
    Caner" <mtol@....edu>, "Sunar, Berk" <sunar@....edu>,
    "Doroz,
    Yarkin" <ydoroz@....edu>,
    "Todd C. Miller" <Todd.Miller@...rtesan.com>
Subject: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH

Peter Gutmann <pgut001@...auckland.ac.nz> wrote:

> The general feeling was that it's best just to grin and bear it, you're going
> to get them at some point no matter what you do.

This is about two things:

1. a false claim of succesfull exploitation of OpenSSH in a paper.
2. a false claim based upon that paper lands in a CVE.

You are only talking about point 2.  We are talking about point 1 also.

We don't need to grin and bear either, but especially point 1.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.