Hacker News
points by gquere 2 days ago | 0 comments
Why is this not yet published on the official website and why is there no CVE? https://www.openssh.org/security.html

Edit: My bad as pointed below this is not in OpenSSH but in musl and it appears in the relase notes https://www.openssh.org/releasenotes.html#10.6p2. I had scrolled straight to the bottom of the website because the animations annoyed me. Still would like a CVE for proper tracking though!

[–] doodlesdev 2 days ago
OpenSSH considers this to be a vulnerability in musl and not OpenSSH, but shipped a fix anyways since that helps mitigate impact... Whether you agree with that or not, it's up to you :)
[–] mkj 2 days ago
Probably because mitre take days to weeks to give out CVE numbers (if ever). Just get the fix out there.
Hacker News