The version number lies
Comparing your installed version against the upstream release that fixed a bug is the wrong check on a distribution package. Debian's openssh-server reports 10.0p2 while its changelog states it backported security fixes from 10.3p1, and references twenty CVE identifiers. The version number is deliberately held still.
Your SSH reports ten point zero. The fix shipped in ten point four. You are probably fine anyway.
The obvious check is to compare what you run against the release that fixed the bug. On a distribution package, that check gives the wrong answer.
This machine reports ten point oh, p two. Upstream fixed eight issues in ten point four, so it looks four releases behind.
Open the changelog that ships with the package. It says, in plain words: backport minor security fixes from ten point three, p one.
The fixes were lifted out of the newer release and put into the old one. The version number never moved. That same file references twenty different CVE numbers.
A version number tells you which branch you are on, not which patches you carry. Distributions hold the number still on purpose, so that updating cannot break you.
Check the package changelog, not the upstream version.
#linux#security#ssh#debian#sysadmin
❯ Check the package changelog, not the upstream version.