Trivial authentication bypass in libssh leaves servers wide open | Ars Technica: "A search on Shodan showed 6,351 sites using libssh, but knowing how meaningful the results are is challenging. For one thing, the search probably isn’t exhaustive. And for another, as is the case with GitHub, the use of libssh doesn’t automatically make a site vulnerable."

Labels: security is hard