romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-05-30 11:37:28 +03:00
Code Issues Projects Releases Packages Wiki Activity

url: check SSH config match on connection reuse

Browse source 
CVE-2022-27782

Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2022-27782.html
Closes #8825
This commit is contained in:
Daniel Stenberg 2022-05-09 23:13:53 +02:00
parent f18af4f874
commit 1645e9b445
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/url.c
View file

@ -1100,6 +1100,12 @@ static void prune_dead_connections(struct Curl_easy *data)
}
}
static bool ssh_config_matches(struct connectdata *one,
struct connectdata *two)
{
return (Curl_safecmp(one->proto.sshc.rsa, two->proto.sshc.rsa) &&
Curl_safecmp(one->proto.sshc.rsa_pub, two->proto.sshc.rsa_pub));
}
/*
* Given one filled in connection struct (named needle), this function should
* detect if there already is one that has all the significant details
@ -1356,6 +1362,11 @@ ConnectionExists(struct Curl_easy *data,
(data->state.httpwant < CURL_HTTP_VERSION_2_0))
continue;
if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) {
if(!ssh_config_matches(needle, check))
continue;
}
if((needle->handler->flags&PROTOPT_SSL)
#ifndef CURL_DISABLE_PROXY
|| !needle->bits.httpproxy || needle->bits.tunnel_proxy

6
lib/vssh/ssh.h
View file

@ -7,7 +7,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2022, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -131,8 +131,8 @@ struct ssh_conn {
/* common */
const char *passphrase; /* pass-phrase to use */
char *rsa_pub; /* path name */
char *rsa; /* path name */
char *rsa_pub; /* strdup'ed public key file */
char *rsa; /* strdup'ed private key file */
bool authed; /* the connection has been authenticated fine */
bool acceptfail; /* used by the SFTP_QUOTE (continue if
quote command fails) */