Another issue has been fixed upstream, CVE-2016-8858 in 7.3p1-2: http://metadata.ftp-master.debian.org/changelogs/main/o/openssh/unstable_changelog

Is there anything I can do to progress this? I have some Debian packaging progression.

I have:

• stable and stable-security 1:6.7p1-5+deb8u3
• unstable 1:7.3p1-5

AFAIK that matches packages.debian.org/openssh-client

But the repository here doesn't seem up to date... Is thisopensshpackage really used @walshb , @CenturionDan ?

I have on Testing:

Package: openssh-client
Version: 1:7.1p2-2+devuan1

Package: openssh-server
Version: 1:7.1p2-2+devuan1

I last updated it a while ago -- it's working for me on my machine, but haven't updated recently. Will take a look. As for "really used" -- not sure whether it's included in the build. CenturionDan will know.

See http://auto.mirror.devuan.org/merged/dists/ascii/main/binary-amd64/Packages.xz , search for 'Package: openssh'.

I have now installed the normal packages from unstable.