4

Looking at the CVE security vulnerabilities statistics of OpenSSH server (http://www.cvedetails.com/product/585/Openbsd-Openssh.html?vendor_id=97), I'm wondering why OpenSSH had so many bugs than other SSH server like Tectia (https://www.cvedetails.com/product/3377/SSH-Tectia-Server.html?vendor_id=120). Is it only because of OpenSSH is free and open-source?

  • 17
    For starters, OpenSSH usage is more widespread than Tectia by a factor of a million (conservatively), so people looking for vulnerabilities look at OpenSSH first. Also being open-source, vulnerabilities that are found and patched will likely always get a CVE. For a closed-source project, you have no idea how many vulnerabilities were found and quietly patched with no notice or explanation. – Stephen Touset Mar 20 '17 at 23:01
4

Found bugs for OpenSSH will have larger impact as it is the most popular SSH implementation nowadays. On one side, it is useful as it means security professionals pay more attention to OpenSSH so that developers can update the system more often. As long as sysadmin always keep their software updated and patch them whenever there are known vulnerabilities, then it's good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.