If we're still talking about the Debian SSH key bug in 2008, here is the Debian bug (from 2006) that led to the security issue, which was discovered in 2008: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=363516.

Upstream was contacted about it: https://marc.info/?t=114651088900003&r=1&w=2