Does an SSH version banner prove a server is vulnerable?

No. It is a strong hint, not proof, in both directions. The banner is the text a server announces about its software, such as OpenSSH_8.9p1 Ubuntu-3ubuntu0.10. Linux distributions often fix security flaws by patching the old version instead of moving to the new upstream release, so a server can announce a version listed as affected and still be safe; the distribution's package suffix and its security tracker tell you. The banner can also be changed or hidden by an administrator, and some appliances announce misleading strings. Conversely, a current version number does not rule out problems in configuration, such as password logins open to the internet or weak host keys. Use the banner to sort servers into those worth checking first and those that are probably fine, then confirm on the host with the package manager or with an authenticated vulnerability scan. Never report a server to management as compromised or vulnerable on the strength of its banner alone.

← All 40 questions on Encryption and encrypted trafficAll topics