I tried searching but couldn’t find any info about the patch state for Manjaro. To me it looks unpatched as of yet and i don’t see anyone talking about it. Am i correct with this? Is there progress beeing made with providiing a patched version?
For anyone who wants to take immediate action: apparently it can be mitigated by setting LoginGraceTime 0:
can be fixed by simply setting LoginGraceTime to 0 in the
configuration file. This makes sshd vulnerable to a denial of service
(the exhaustion of all MaxStartups connections), but it makes it safe
from the remote code execution presented in this advisory.
The exploit currently only works on 32-bit systems. A 64-bit version is in the works:
“The exploit only works in about every ten thousandth attempt, after the standard 120-second timeout (LoginGraceTime) has expired…”
The exploit for x64 is said to be significantly slower than the one for i386. It may take a week for the attack to break in.
So there is no reason to act hastily and no reason to panic. (One must also consider the circumstances surrounding the XZ problem. In particular the pressure that was exerted at the time (thankfully unsuccessfully))
I know that there currently only is a working exploit for 32-Bit systems. However, a 64-Bit exploit is only a matter of time. Therefore, a fast patch would be preferable to not even get into potential unclear situations once an exploit drops. Not panicing is advisible and the update should not break existing deployments, however, even large distributions with a focus on stable packages like Debian and Ubuntu understood this and already backported minimal patches anyway.
Also, the comparison to the XZ situation does not fit at all. In XZ, the malicious actor pressed for an update with the excuse to to get obscure new features into the library. For OpenSSH, there is a well documented blog post for a fixed security vulnerability that is backed by a stable team of developers (see their release notes on openssh dot com) for a product that did no have a critical vulnerability in at least a decade.
