Comment by pera
2 days ago
I thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?
2 days ago
I thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?
Some use Dropbear, some use openssh.
This vulnerability clearly is not one that affects everyone like the PHP vulnerability did. But it's exposure is still significant and very easy to exploit. As easy as it gets.
Well, OpenWrt is OpenSSH + musl.
OpenWrt uses Dropbear by default:
https://openwrt.org/docs/guide-user/services/ssh/transfer_dr...
We don’t know that dropbear isn’t vulnerable. The bug here is in musl and OpenSSH is just being a bro by working around it
2 replies →