openssh-server for stable has CVE vulnerability

[schwart]

I'm a longterm debian user but seeing latest security fix is not
delivered - Should I start using `sid` for everything now??