&gt; CVE-2016-0778... is &quot;unlikely to have any real-world impact&quot; because it relies on two non-default options being used by the client (ProxyCommand and either ForwardAgent or ForwardX11)<p><i>cringe</i> -- I know I&#x27;ve got both in my ~&#x2F;.ssh&#x2F;config, though hopefully not both enabled for the same server(s).