47 lines
1.5 KiB
Diff
47 lines
1.5 KiB
Diff
From 03bbbc9e4c93aae2ccdd302d6123e4809be37746 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Thu, 14 Dec 2023 12:22:01 +0100
|
|
Subject: [PATCH 3/4] CVE-2023-48795: Strip extensions from both kex lists for
|
|
matching
|
|
|
|
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
|
|
|
|
Conflict: NA
|
|
Reference:https://gitlab.com/libssh/libssh-mirror/-/commit/03bbbc9e4c93aae2ccdd302d6123e4809be37747
|
|
---
|
|
src/kex.c | 16 ++++++++++++----
|
|
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/kex.c b/src/kex.c
|
|
index e37c176c..eea3604b 100644
|
|
--- a/src/kex.c
|
|
+++ b/src/kex.c
|
|
@@ -936,11 +936,19 @@ int ssh_kex_select_methods (ssh_session session)
|
|
enum ssh_key_exchange_e kex_type;
|
|
int i;
|
|
|
|
- /* Here we should drop the ext-info-c from the list so we avoid matching.
|
|
+ /* Here we should drop the extensions from the list so we avoid matching.
|
|
* it. We added it to the end, so we can just truncate the string here */
|
|
- ext_start = strstr(client->methods[SSH_KEX], ","KEX_EXTENSION_CLIENT);
|
|
- if (ext_start != NULL) {
|
|
- ext_start[0] = '\0';
|
|
+ if (session->client) {
|
|
+ ext_start = strstr(client->methods[SSH_KEX], "," KEX_EXTENSION_CLIENT);
|
|
+ if (ext_start != NULL) {
|
|
+ ext_start[0] = '\0';
|
|
+ }
|
|
+ }
|
|
+ if (session->server) {
|
|
+ ext_start = strstr(server->methods[SSH_KEX], "," KEX_STRICT_SERVER);
|
|
+ if (ext_start != NULL) {
|
|
+ ext_start[0] = '\0';
|
|
+ }
|
|
}
|
|
|
|
for (i = 0; i < SSH_KEX_METHODS; i++) {
|
|
--
|
|
2.33.0
|
|
|