'Terrapin' vulnerability - and suggested ciphers

[jesusbagpuss]

The ssh config guidance includes ciphers that are part of the https://terrapin-attack.com/ vulnerability e.g.
https://github.com/mozilla/infosec.mozilla.org/blob/bb3f88ef1df6b0bc31b5c09b7f8ec00431b6a60c/docs/guidelines/openssh.md?plain=1#L36C9-L36C38

The guidance on the above site is:

If you feel uncomfortable waiting for your SSH implementation to provide a patch, you can workaround this vulnerability by temporarily disabling the affected [email protected] encryption and [email protected] MAC algorithms in the configuration of your SSH server (or client), and use unaffected algorithms like AES-GCM instead.

Not sure if removing the [email protected] cipher from the suggested config, or referencing the vulnerability and impacted versions of openSSH server/clients is the best option.

[SuperSandro2000]

Is the connection only downgraded to any other enabled cipher? Then we would worst case use the second best cipher which IMO does not warrant doesn't poly chacha. As openssh wrote, this does not impact confidentially or secrecy.