Helsinki, Finland -
November 7, 2001
SSH statement regarding the vulnerability of SSH1 protocol
There are several vulnerability issues with version 1 of the Secure Shell protocol (SSH1). While version 1 of the protocol is deprecated, it is still widely used.
SSH Communications Security recommends that everyone switches to using version 2 of the Secure Shell protocol (SSH2). The latest version of SSH Secure Shell, ssh-3.0.0, can be obtained from our ftp site for non-commercial use, or from our online store for commercial use.
See the deprecation message for more information about the deprecation of the SSH1 protocol. A summary of some of the vulnerabilities in the SSH1 protocol is also available, outlining some of the known vulnerabilities in the SSH1 protocol. The CERT Coordination Center (CERT/CC) has issued a set of vulnerability notes outlining some of the weaknesses found in SSH1.
The CERT/CC vulnerability notes will not affect customers of SSH Communications Security who are using version 2.x or 3.x of the SSH Secure Shell products. Only users who are still using version 1.x of the products, or using any compatible product that implements the version 1 protocol, are affected.
If you are a user of an SSH1-based product, we strongly recommend that you move to using an SSH2-based product as soon as possible. ssh-3.0.0 is freely available for any use on Linux, FreeBSD, NetBSD, OpenBSD, as well as for use by universities and charity organizations and personal hobby/recreational use by individuals. Commercial use on platforms other than the ones listed here requires a commercial license.
Please contact our sales or visit our online store for more information.
Shiho Hashimoto
SSH Communications Security Corp.
Tel: +358 20 500 7470
E-mail:
SSH Communications Security recommends that everyone switches to using version 2 of the Secure Shell protocol (SSH2). The latest version of SSH Secure Shell, ssh-3.0.0, can be obtained from our ftp site for non-commercial use, or from our online store for commercial use.
See the deprecation message for more information about the deprecation of the SSH1 protocol. A summary of some of the vulnerabilities in the SSH1 protocol is also available, outlining some of the known vulnerabilities in the SSH1 protocol. The CERT Coordination Center (CERT/CC) has issued a set of vulnerability notes outlining some of the weaknesses found in SSH1.
The CERT/CC vulnerability notes will not affect customers of SSH Communications Security who are using version 2.x or 3.x of the SSH Secure Shell products. Only users who are still using version 1.x of the products, or using any compatible product that implements the version 1 protocol, are affected.
If you are a user of an SSH1-based product, we strongly recommend that you move to using an SSH2-based product as soon as possible. ssh-3.0.0 is freely available for any use on Linux, FreeBSD, NetBSD, OpenBSD, as well as for use by universities and charity organizations and personal hobby/recreational use by individuals. Commercial use on platforms other than the ones listed here requires a commercial license.
Please contact our sales or visit our online store for more information.
SSH Corp. Contact
George Adams
SSH Communications Security Corp.
Tel: +1 781 247 2100
E-mail: 
Americas Contact
Byron Rashed
SSH Communications Security, Inc.
Tel: +1 650 251 2721
E-mail: 
Europe Contact
Bo Sorensen
SSH Communications Security Corp.
Tel: +358 20 500 7404
E-mail: 
Investor Relations
Mika Peuranen
SSH Communications Security Corp.
Tel: +358 20 500 7419
E-mail: 
U.S. Agency Contact
Cheryl Seaberg
Walt & Company
Tel: +1 408 496 0900 x 2981
E-mail: 
Shiho Hashimoto
SSH Communications Security Corp.
Tel: +358 20 500 7470
E-mail:
© 2002 SSH Communications Security Corp. All rights reserved. ssh® is a registered trademark of SSH Communications Security Corp in the United States and in certain other jurisdictions. All other names and marks are property of their respective owners.