60 lines
2.0 KiB
Diff
60 lines
2.0 KiB
Diff
From: Jakub Witczak <kuba@erlang.org>
|
|
Date: Fri, 21 Mar 2025 12:17:07 +0100
|
|
Subject: [PATCH] ssh: ignore too long names
|
|
|
|
origin: backport, https://github.com/erlang/otp/commit/655e20a49ef80431e86ffb6c7f366d01fd4b64c3
|
|
bug: https://github.com/erlang/otp/security/advisories/GHSA-vvr3-fjhh-cfwc
|
|
bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1101713
|
|
|
|
[backport]
|
|
Drop CVE-2025-30211-1.patch from bookworm that does not apply and is cosmetic
|
|
---
|
|
lib/ssh/src/ssh_message.erl | 20 ++++++++++++++++++--
|
|
1 file changed, 18 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/lib/ssh/src/ssh_message.erl b/lib/ssh/src/ssh_message.erl
|
|
index fab9c50..b78d755 100644
|
|
--- a/lib/ssh/src/ssh_message.erl
|
|
+++ b/lib/ssh/src/ssh_message.erl
|
|
@@ -24,6 +24,7 @@
|
|
-module(ssh_message).
|
|
|
|
-include_lib("public_key/include/public_key.hrl").
|
|
+-include_lib("kernel/include/logger.hrl").
|
|
|
|
-include("ssh.hrl").
|
|
-include("ssh_connect.hrl").
|
|
@@ -37,6 +38,7 @@
|
|
|
|
-behaviour(ssh_dbg).
|
|
-export([ssh_dbg_trace_points/0, ssh_dbg_flags/1, ssh_dbg_on/1, ssh_dbg_off/1, ssh_dbg_format/2]).
|
|
+-define(ALG_NAME_LIMIT, 64).
|
|
|
|
|
|
ucl(B) ->
|
|
@@ -727,8 +729,22 @@ decode_kex_init(<<?BYTE(Bool)>>, Acc, 0) ->
|
|
X = 0,
|
|
list_to_tuple(lists:reverse([X, erl_boolean(Bool) | Acc]));
|
|
decode_kex_init(<<?DEC_BIN(Data,__0), Rest/binary>>, Acc, N) ->
|
|
- Names = string:tokens(?unicode_list(Data), ","),
|
|
- decode_kex_init(Rest, [Names | Acc], N -1).
|
|
+ BinParts = binary:split(Data, <<$,>>, [global]),
|
|
+ Process =
|
|
+ fun(<<>>, PAcc) ->
|
|
+ PAcc;
|
|
+ (Part, PAcc) ->
|
|
+ case byte_size(Part) > ?ALG_NAME_LIMIT of
|
|
+ true ->
|
|
+ ?LOG_DEBUG("Ignoring too long name", []),
|
|
+ PAcc;
|
|
+ false ->
|
|
+ Name = binary:bin_to_list(Part),
|
|
+ [Name | PAcc]
|
|
+ end
|
|
+ end,
|
|
+ Names = lists:foldr(Process, [], BinParts),
|
|
+ decode_kex_init(Rest, [Names | Acc], N - 1).
|
|
|
|
|
|
%%%================================================================
|