if (cfg.sshbug_derivekey2 == BUG_ON ||
(cfg.sshbug_derivekey2 == BUG_AUTO &&
- (wc_match("2.0.*", imp)))) {
+ (wc_match("2.0.0*", imp) || wc_match("2.0.1[01]*", imp) ))) {
/*
* These versions have the key-derivation bug (failing to
* include the literal shared secret in the hashes that