← Fixed vulnerabilities
Fixed
OpenSSH Keystroke Obfuscation Bypass
FreeBSD-SA-25:01.openssh · CVE-2024-39894
Our decision for FreeSense
FreeBSD corrected this on 2024-07-15, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2024-07-15
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
Decided by rules, not yet reviewed. The status comes from the advisory's correction date and the build configuration. A maintainer has not looked at whether FreeSense is exposed in practice. How we triage
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available. This bug does not affect connections when ObscureKeystrokeTiming was disabled or sessions where no TTY was requested.
What FreeBSD says
A logic error in the ssh(1) ObscureKeystrokeTiming feature (on by default) rendered this feature ineffective.
Impact
A passive observer could detect which network packets contain real keystrokes, and infer the specific characters being transmitted from packet timing.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.