8 ms·
The only mosh CVE [1] was in the terminal emulator (a DoS that could only be triggered by a local user), not in the protocol. There have been no vulnerabilities
by achernya 4y ago
The only mosh CVE [1] was in the terminal emulator (a DoS that could only be triggered by a local user), not in the protocol. There have been no vulnerabilities in mosh's UDP protocol.
[1] https://nvd.nist.gov/vuln/detail/CVE-2012-2385 https://nvd.nist.gov/vuln/detail/CVE-2012-2385
- nibbleshifter 4y agoyet. I wonder if anyone's thrown a fuzzer at it.
- achernya 4y agoYes, mosh has fuzz tests in oss-fuzz [1]. [1] https://github.com/google/oss-fuzz/tree/master/projects/mosh https://github.com/google/oss-fuzz/tree/master/projects/mosh