From 5846e57538c750c5ce67df887d09fa99861c79c6 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Thu, 14 Dec 2023 12:22:01 +0100 Subject: [PATCH] CVE-2023-48795: Strip extensions from both kex lists for matching Signed-off-by: Jakub Jelen Reviewed-by: Andreas Schneider Upstream-Status: Backport [https://gitlab.com/libssh/libssh-mirror/-/commit/5846e57538c750c5ce67df887d09fa99861c79c6] CVE: CVE-2023-48795 Signed-off-by: Vijay Anusuri --- src/kex.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/src/kex.c b/src/kex.c index b03e6484..c100d908 100644 --- a/src/kex.c +++ b/src/kex.c @@ -857,11 +857,19 @@ int ssh_kex_select_methods (ssh_session session){ char *ext_start = NULL; int i; - /* Here we should drop the ext-info-c from the list so we avoid matching. + /* Here we should drop the extensions from the list so we avoid matching. * it. We added it to the end, so we can just truncate the string here */ - ext_start = strstr(client->methods[SSH_KEX], ","KEX_EXTENSION_CLIENT); - if (ext_start != NULL) { - ext_start[0] = '\0'; + if (session->client) { + ext_start = strstr(client->methods[SSH_KEX], "," KEX_EXTENSION_CLIENT); + if (ext_start != NULL) { + ext_start[0] = '\0'; + } + } + if (session->server) { + ext_start = strstr(server->methods[SSH_KEX], "," KEX_STRICT_SERVER); + if (ext_start != NULL) { + ext_start[0] = '\0'; + } } for (i = 0; i < KEX_METHODS_SIZE; i++) { -- 2.25.1