4

Looking at the CVE security vulnerabilities statistics of OpenSSH server (http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97), I'm wondering why OpenSSH had so many bugs than other SSH server like Tectia (https://www.cvedetails.com/product/3377/SSH-Tectia-Server.html?vendor_id=120). Is it only because of OpenSSH is free and open-source?

1
  • 17
    For starters, OpenSSH usage is more widespread than Tectia by a factor of a million (conservatively), so people looking for vulnerabilities look at OpenSSH first. Also being open-source, vulnerabilities that are found and patched will likely always get a CVE. For a closed-source project, you have no idea how many vulnerabilities were found and quietly patched with no notice or explanation. Mar 20, 2017 at 23:01

1 Answer 1

4

Found bugs for OpenSSH will have larger impact as it is the most popular SSH implementation nowadays. On one side, it is useful as it means security professionals pay more attention to OpenSSH so that developers can update the system more often. As long as sysadmin always keep their software updated and patch them whenever there are known vulnerabilities, then it's good.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .