A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
Credits
Red Hat would like to thank Fabian Bäumer and Marcus Brinkmann for reporting this issue.
