From 5846e57538c750c5ce67df887d09fa99861c79c6 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Thu, 14 Dec 2023 12:22:01 +0100
Subject: [PATCH] CVE-2023-48795: Strip extensions from both kex lists for
 matching

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

Upstream-Status: Backport [https://gitlab.com/libssh/libssh-mirror/-/commit/5846e57538c750c5ce67df887d09fa99861c79c6]
CVE: CVE-2023-48795
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 src/kex.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/kex.c b/src/kex.c
index b03e6484..c100d908 100644
--- a/src/kex.c
+++ b/src/kex.c
@@ -857,11 +857,19 @@ int ssh_kex_select_methods (ssh_session session){
     char *ext_start = NULL;
     int i;
 
-    /* Here we should drop the  ext-info-c  from the list so we avoid matching.
+    /* Here we should drop the extensions from the list so we avoid matching.
      * it. We added it to the end, so we can just truncate the string here */
-    ext_start = strstr(client->methods[SSH_KEX], ","KEX_EXTENSION_CLIENT);
-    if (ext_start != NULL) {
-        ext_start[0] = '\0';
+    if (session->client) {
+	ext_start = strstr(client->methods[SSH_KEX], "," KEX_EXTENSION_CLIENT);
+	if (ext_start != NULL) {
+	    ext_start[0] = '\0';
+	}
+    }
+    if (session->server) {
+	ext_start = strstr(server->methods[SSH_KEX], "," KEX_STRICT_SERVER);
+	if (ext_start != NULL) {
+	    ext_start[0] = '\0';
+	}
     }
 
     for (i = 0; i < KEX_METHODS_SIZE; i++) {
-- 
2.25.1

