44 lines
1.4 KiB
Diff
44 lines
1.4 KiB
Diff
From 5846e57538c750c5ce67df887d09fa99861c79c6 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Thu, 14 Dec 2023 12:22:01 +0100
|
|
Subject: [PATCH 13/20] CVE-2023-48795: Strip extensions from both kex lists
|
|
for matching
|
|
|
|
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
|
|
---
|
|
src/kex.c | 16 ++++++++++++----
|
|
1 file changed, 12 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/kex.c b/src/kex.c
|
|
index 9ad671db..fbc70cf4 100644
|
|
--- a/src/kex.c
|
|
+++ b/src/kex.c
|
|
@@ -961,11 +961,19 @@ int ssh_kex_select_methods (ssh_session session)
|
|
enum ssh_key_exchange_e kex_type;
|
|
int i;
|
|
|
|
- /* Here we should drop the ext-info-c from the list so we avoid matching.
|
|
+ /* Here we should drop the extensions from the list so we avoid matching.
|
|
* it. We added it to the end, so we can just truncate the string here */
|
|
- ext_start = strstr(client->methods[SSH_KEX], ","KEX_EXTENSION_CLIENT);
|
|
- if (ext_start != NULL) {
|
|
- ext_start[0] = '\0';
|
|
+ if (session->client) {
|
|
+ ext_start = strstr(client->methods[SSH_KEX], "," KEX_EXTENSION_CLIENT);
|
|
+ if (ext_start != NULL) {
|
|
+ ext_start[0] = '\0';
|
|
+ }
|
|
+ }
|
|
+ if (session->server) {
|
|
+ ext_start = strstr(server->methods[SSH_KEX], "," KEX_STRICT_SERVER);
|
|
+ if (ext_start != NULL) {
|
|
+ ext_start[0] = '\0';
|
|
+ }
|
|
}
|
|
|
|
for (i = 0; i < SSH_KEX_METHODS; i++) {
|
|
--
|
|
2.33.0
|
|
|