diff options
Diffstat (limited to 'meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch')
-rw-r--r-- | meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch | 95 |
1 files changed, 95 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch new file mode 100644 index 0000000000..0ba8c312d0 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch | |||
@@ -0,0 +1,95 @@ | |||
1 | From 7ef3787c84b6b524501211b11a26c742f829af1a Mon Sep 17 00:00:00 2001 | ||
2 | From: "djm@openbsd.org" <djm@openbsd.org> | ||
3 | Date: Mon, 18 Dec 2023 14:47:44 +0000 | ||
4 | Subject: [PATCH] upstream: ban user/hostnames with most shell metacharacters | ||
5 | |||
6 | This makes ssh(1) refuse user or host names provided on the | ||
7 | commandline that contain most shell metacharacters. | ||
8 | |||
9 | Some programs that invoke ssh(1) using untrusted data do not filter | ||
10 | metacharacters in arguments they supply. This could create | ||
11 | interactions with user-specified ProxyCommand and other directives | ||
12 | that allow shell injection attacks to occur. | ||
13 | |||
14 | It's a mistake to invoke ssh(1) with arbitrary untrusted arguments, | ||
15 | but getting this stuff right can be tricky, so this should prevent | ||
16 | most obvious ways of creating risky situations. It however is not | ||
17 | and cannot be perfect: ssh(1) has no practical way of interpreting | ||
18 | what shell quoting rules are in use and how they interact with the | ||
19 | user's specified ProxyCommand. | ||
20 | |||
21 | To allow configurations that use strange user or hostnames to | ||
22 | continue to work, this strictness is applied only to names coming | ||
23 | from the commandline. Names specified using User or Hostname | ||
24 | directives in ssh_config(5) are not affected. | ||
25 | |||
26 | feedback/ok millert@ markus@ dtucker@ deraadt@ | ||
27 | |||
28 | OpenBSD-Commit-ID: 3b487348b5964f3e77b6b4d3da4c3b439e94b2d9 | ||
29 | |||
30 | CVE: CVE-2023-51385 | ||
31 | Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a] | ||
32 | Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> | ||
33 | Comment: Hunks refreshed to apply cleanly | ||
34 | |||
35 | --- | ||
36 | ssh.c | 41 ++++++++++++++++++++++++++++++++++++++++- | ||
37 | 1 file changed, 40 insertions(+), 1 deletion(-) | ||
38 | |||
39 | diff --git a/ssh.c b/ssh.c | ||
40 | index 35c48e62d18..48d93ddf2a9 100644 | ||
41 | --- a/ssh.c | ||
42 | +++ b/ssh.c | ||
43 | @@ -583,6 +583,41 @@ set_addrinfo_port(struct addrinfo *addrs | ||
44 | } | ||
45 | } | ||
46 | |||
47 | +static int | ||
48 | +valid_hostname(const char *s) | ||
49 | +{ | ||
50 | + size_t i; | ||
51 | + | ||
52 | + if (*s == '-') | ||
53 | + return 0; | ||
54 | + for (i = 0; s[i] != 0; i++) { | ||
55 | + if (strchr("'`\"$\\;&<>|(){}", s[i]) != NULL || | ||
56 | + isspace((u_char)s[i]) || iscntrl((u_char)s[i])) | ||
57 | + return 0; | ||
58 | + } | ||
59 | + return 1; | ||
60 | +} | ||
61 | + | ||
62 | +static int | ||
63 | +valid_ruser(const char *s) | ||
64 | +{ | ||
65 | + size_t i; | ||
66 | + | ||
67 | + if (*s == '-') | ||
68 | + return 0; | ||
69 | + for (i = 0; s[i] != 0; i++) { | ||
70 | + if (strchr("'`\";&<>|(){}", s[i]) != NULL) | ||
71 | + return 0; | ||
72 | + /* Disallow '-' after whitespace */ | ||
73 | + if (isspace((u_char)s[i]) && s[i + 1] == '-') | ||
74 | + return 0; | ||
75 | + /* Disallow \ in last position */ | ||
76 | + if (s[i] == '\\' && s[i + 1] == '\0') | ||
77 | + return 0; | ||
78 | + } | ||
79 | + return 1; | ||
80 | +} | ||
81 | + | ||
82 | /* | ||
83 | * Main program for the ssh client. | ||
84 | */ | ||
85 | @@ -1069,6 +1104,10 @@ main(int ac, char **av) | ||
86 | if (!host) | ||
87 | usage(); | ||
88 | |||
89 | + if (!valid_hostname(host)) | ||
90 | + fatal("hostname contains invalid characters"); | ||
91 | + if (options.user != NULL && !valid_ruser(options.user)) | ||
92 | + fatal("remote username contains invalid characters"); | ||
93 | host_arg = xstrdup(host); | ||
94 | |||
95 | /* Initialize the command to execute on remote host. */ | ||