CVE-2024-7589 (OpenSSH pre-authentication)

[InFlammen]

I believe this urgent patch couldn't make it in 24.7.1 ? 

https://www.freebsd.org/security/advisories/FreeBSD-SA-24:08.openssh.asc
https://thehackernews.com/2024/08/freebsd-releases-urgent-patch-for-high.html

[franco]

We don't build OpenSSH from src.git:

https://github.com/opnsense/tools/blob/382f837cd0d4b0478202ac26c85c4dea5b09d6ee/config/24.7/src.conf#L24

And in ports apparently you need the BLACKLISTD option to be vulnerable for openssh-portable:

# pkg info openssh-portable | grep BLACKLISTD
   BLACKLISTD     : off


Cheers,
Franco

[InFlammen]

Good to know. Thanks!!!