Comment by gquere
2 days ago
Why is this not yet published on the official website and why is there no CVE? https://www.openssh.org/security.html
Edit: My bad as pointed below this is not in OpenSSH but in musl and it appears in the relase notes https://www.openssh.org/releasenotes.html#10.6p2. I had scrolled straight to the bottom of the website because the animations annoyed me. Still would like a CVE for proper tracking though!
OpenSSH considers this to be a vulnerability in musl and not OpenSSH, but shipped a fix anyways since that helps mitigate impact... Whether you agree with that or not, it's up to you :)
Probably because mitre take days to weeks to give out CVE numbers (if ever). Just get the fix out there.