The only mosh CVE [1] was in the terminal emulator (a DoS that could only be tri... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

achernya on Nov 24, 2022 | parent | context | favorite | on: Mosh: An Interactive Remote Shell for Mobile Clien...

The only mosh CVE [1] was in the terminal emulator (a DoS that could only be triggered by a local user), not in the protocol. There have been no vulnerabilities in mosh's UDP protocol.

[1] https://nvd.nist.gov/vuln/detail/CVE-2012-2385

nibbleshifter on Nov 24, 2022 [–]

yet.

I wonder if anyone's thrown a fuzzer at it.

achernya on Nov 24, 2022 | [–]

Yes, mosh has fuzz tests in oss-fuzz [1].

[1] https://github.com/google/oss-fuzz/tree/master/projects/mosh

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact