OpenSSH client side vulnerability CVE-2016-0777 fixed in upcoming 7.1p2 release

"The authentication of the server host key prevents exploitation by a man-in-the-middle, so this information leak is restricted to connections to malicious or compromised servers."

http://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Jan...

Btw, there will be some clumsy-admin fallout, as putting this into sshd_config by mistake will cause a running-but-unreachable SSH daemon. (Guess how I found out ;))