a34a370f4e
The affected code isn't present in any release, see [0]. [0]: https://www.libssh.org/2023/07/14/cve-2023-3603-potential-null-dereference-in-libsshs-sftp-server/ The CPE entry for this CVE is cpe:2.3🅰️libssh:libssh:-:*:*:*:*:*:*:* We interpret the "-" as matching any version. It actually means "unspecified version", which is the cop-out in case there is nothing useful to match. We can't really make our infrastructure ignore "-" entirely, because for all we know our version is an unreleased commit sha which _is_ vulnerable. Thus, the only way out is an exclusion which we'll never be able to remove. Signed-off-by: Daniel Lang <dalang@gmx.at> Signed-off-by: Arnout Vandecappelle <arnout@mind.be> |
||
|---|---|---|
| .. | ||
| Config.in | ||
| libssh.hash | ||
| libssh.mk | ||