I should add that most (all?) of the _bugs_ filed by the Redhat maintainer (Thomas Mraz)
against OpenSSH are closed, mostly because he writes great bug reports and makes his patches
very easy to merge. He is probably the easiest distribution representative to deal with.