Hello everyone, today another OpenSSH security bulletin.
OpenSSH is the first connectivity tool for remote connection using the SSH protocol.
It uses traffic encryption to eliminate eavesdropping, connection hijacking and other attacks.
As a result of this new vulnerability, OpenSSH is vulnerable to a machine-in-the-middle attack caused by a flaw in the protocol’s extension negotiation process.
When used with certain extensions, a remote attacker can exploit this vulnerability to launch a machine-in-the-middle attack and strip an arbitrary number of messages after the initial key exchange.
The effect of this attack would be to break the exchange of protocol extensions and possibly downgrade the client connection.
To correct this CVSS 5.9 vulnerability, you need to apply the following PTF (which you can find here:https://lnkd.in/e7RAfv9u )
