See https://marc.info/?l=oss-security&m=167892203725404&w=2: ``` We discovered a minor stack-based buffer overflow in OpenBSD's libskey; it was introduced in July 1997 by the following commit: https://github.com/openbsd/src/commit/ea55ee16580e7b47c83712c5fd50615f8b1d26ad and was fixed today by the following commit (thanks to OpenBSD for their incredibly quick response!): https://github.com/openbsd/src/commit/848ef98a011b51fa811cb86fe900433edd2db24a and although the vulnerable function is reachable remotely via OpenSSH, this bug is useless in practice: - the hostname of the affected system must be longer than 126 characters to trigger this buffer overflow; - the characters that overflow this buffer are all '\0' characters (the filler characters of a strncpy() call). [...] ```
Please stable when ready, thanks!
Dropped the buggy r13 revision.
