🚨 Critical: SSH-MITM & Associated Docker Container Outdated for 2 Years – 11 Documented Vulnerabilities Unpatched!

[littlebear2]

First and foremost, I want to express my gratitude for the hard work and effort you've invested in creating SSH-MITM. It's an invaluable resource for the community.

However, I've noticed a few concerning issues and would like to outline them for clarity:

• Outdated Software: SSH-MITM and its corresponding Docker container positronsecurity/ssh-mitm have been stagnant for about two years without updates.
• Known Vulnerabilities: SSH-Audit, another tool from you, has highlighted that SSH-MITM currently contains 11 documented vulnerabilities. These have been addressed in OpenSSH, but remain unpatched in SSH-MITM. The detailed list of these vulnerabilities can be found here.
• Docker Container Vulnerabilities: The Docker container for SSH-MITM, based on Ubuntu 20.04, poses potential threats due to its known vulnerabilities, as documented here. The exact relevance of these to SSH-MITM isn't confirmed, but it's a potential threat.
• Responsibility to Users: As security professionals, we bear a responsibility to ensure the tools we provide are safe and reliable. If there are constraints preventing active maintenance, users should be clearly and prominently informed.
• Reference by SSH.com: Your tool is still being referenced by SSH.com, which may inadvertently give users a false sense of security.

Suggested Actions:

• Address the 11 vulnerabilities in SSH-MITM and update the Docker container to a more secure and recent base.
• Add a clear and prominent warning at the start of the README about the tool's status and associated risks, especially if active maintenance isn't feasible.
• Consider archiving the project on GitHub if there are no plans for future updates. This provides a clear indicator to users that the tool is no longer in active development.

Thank you for your dedication to the security community. I hope this feedback is seen in the constructive spirit it's intended.