And to be clear, this is an issue that resurfaced in August or so of 2016, and is patched in supported OpenSSH daemons[0][1].

[0] https://access.redhat.com/security/cve/cve-2016-6210

[1] https://www.ubuntu.com/usn/usn-3061-1/