Call for testing: OpenSSH 7.3

Darren Tucker dtucker at
Fri Jul 22 20:23:07 AEST 2016

On Fri, Jul 22, 2016 at 7:05 PM, C0r3dump3d <coredump at> wrote:
> but now it's more easy to establish the DOS
> condition in the access to the Openssh server and exhausting the CPU
> resources, any dummy user it can be used!

The snapshot you're using (openssh-SNAP-20160722.tar.gz) was
unfortunately made in the time after the code to cap the password size
at 1k was committed to OpenBSD
but before it was synced into -Portable
As a result your very large password strings are still making it into

Please either grab the code directly from git (you'll need to run
"autoreconf" yourself) or try tomorrow's snapshot and retest it.

Darren Tucker (dtucker at
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

More information about the openssh-unix-dev mailing list