Correction: OpenSSH 3.5p1 has no known vulnerabilities. I run a 3.4p1 with patches backported, and lazily just reported my own version number without bothering to double-check what current release it corresponds to. Sorry.