[ssveCY008]

any more news on this HOT topic


https://it.slashdot.org/story/24/09/25/2...ux-systems

https://cybersecuritynews.com/critical-u...-rce-flaw/

[Sacrogrifo]

* Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
* Full disclosure happening in less than 2 weeks (as agreed with devs).
* Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
* Still no working fix.
* Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot.
* Devs are still arguing about whether or not some of the issues have a security impact.

Source: https://threadreaderapp.com/thread/18381...35132.html

[thecaptainjohnson]

Yes, it's this one https://breachforums.bf/Thread-Undisclos...researcher

[joepa]

Wwwow this sounds scary. What would it be, IP stack of OpenSSH?

[YesMyDark]

Shit is 100% useless and hard to exploit

[azdfgaAG]

sounds like a disaster waiting to happen honestly it’s wild how long they’ve let this sit without a fix crazy how devs can’t handle the truth if it bites them in the code