Multiple CRLF injection vulnerabilities in session.c in OpenSSH before 7.2p2

It is another reason for best practices of just-enough infrastructure -> smaller attack surface: disable unused features and ship server daemons with sane defaults with minimal features enabled.