CentOS, OpenSSH, PCI, CVE-2016-10009

This is a vulnerability where a malicious ssh server can attack the client if the client has connected with ssh-agent forwarding, and has somehow gotten a malicious file installed on the client's filesystem.

I also think TrustWave has vastly overestimated the importance of this issue.

That said, the obvious workaround is to disable agent forwarding in /etc/ssh/sshd_config.

AllowAgentForwarding no

Keep in mind that if the server is compromised, the attacker can just remove that and then wait for hapless admins to connect with their agents. So it's kind of a ridiculous workaround.