Followup on Inquiry about regreSSHion postmortem

[hvjunk]

Rene,

 Please check this the *Official* OpenSSH and tell us why the flags you so vicariously blamed Damien for, is NOT in that file, the latest as of today, ie. that still would be a CVE… for Linux that is… but you seemed to have missed that Rene

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/log.c.diff?ipk=fF83_JCDCKqCJ85QEwn7jbP5Ag2cF3ZCTZ6QbjGp4RE&r1=1.52&r2=1.53&f=h



> On 20 Aug 2025, at 13:56, Rene Malmgren <rene.malmgren at redtoken.ae> wrote:
> 
> Ok I should be clearer here, yes there are merges, but explain to me how a merge conflict would remove the two critical flags. I am not talking about surface here. I am talking about a clear step by step analysis, that shows how the flags got removed.
> 
> /Rene
> ________________________________
> From: Stuart Henderson <stu at spacehopper.org>
> Sent: Wednesday, August 20, 2025 3:07 PM
> To: Rene Malmgren <rene.malmgren at redtoken.ae>
> Cc: openssh-unix-dev at mindrot.org <openssh-unix-dev at mindrot.org>
> Subject: Re: Followup on Inquiry about regreSSHion postmortem
> 
> On 2025/08/20 10:41, Rene Malmgren wrote:
>> Actually, there is no evidence in the available data that such a merge even has happened
> 
> This is simply the way that cross-platform OpenSSH commits are done:
> 
> - they are first made to OpenBSD's CVS tree
> 
> - then they are later merged to openssh-portable git with an "upstream:
> XX" comment and OpenBSD-Commit-ID line (with the RCS ID line synced with
> that from the OpenBSD tree in the commit)
> 
> there is plenty of evidence of this, and nothing on the surface unusual
> about this merge commit compared with others
> 
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev