Terrapin advice

[david-mohr]

I have run the terrapin scanner (https://github.com/RUB-NDS/Terrapin-Scanner) against an our server module and it is reporting as vulnerable. I was wondering if you have any advice on how to mitigate the vulnerability. According to the website https://terrapin-attack.com/

In more technical terms, if your SSH implementations supports (and is configured to offer) the [email protected] encryption algorithm, or any encryption algorithm suffixed -cbc in combination with any MAC algorithm suffixed [email protected], you are vulnerable to Terrapin.

Also

AES-GCM (RFC5647) is not affected by Terrapin

Or perhaps there is a way to enable "strict kex" which (assuming the client also supports it) would also shutdown any attempt to exploit the issue.

Thanks!

[mscdex]

Upgrade to v1.15.0.

[david-mohr]

Works like a charm, thanks