net-ssh 7.3.6 → 7.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1fd91f862a832657da3941f813a7a7d2204b2b08cc0082db740d27e9a23e7cc
-  data.tar.gz: b6f84d4e0ff8391ca7ccaab236c0eda12fdc0d46d7f7751a19d355cbf2b4cd5d
+  metadata.gz: a32034e7f363bc87196ff8a13b8c79bd7e9b246e98375c8e8d505cd52ea0b19a
+  data.tar.gz: d98d516fa2ddc9a8e2718e60ea4367da99ae49b5082ec0b4897db24cc86a625f
 SHA512:
-  metadata.gz: 4b8edaf68052b8b828993179ee6f8a29df1e64ca63e1cad5228d4e58ec50c088b321deaf0ad8a202eb6fe27a9a923be2dbe1dc5569e049634379e64b1d4228d5
-  data.tar.gz: 6b2f300dab731967559d13d6ac18c756c27ff39222dd2370b1e32b4187475cb0103e5e2683dfbe03624d172756232066ee30dc84bed8bfaa7d032c3a9736dd69
+  metadata.gz: d5d09d26af82a639bb793453e27f95b89cb1dbcc15a2bd22ccad8bc7e7106d848008927dbee29b5a8f7c280a15a5bd9eced464c45f004f0c1b64ee2bb1bb8eee
+  data.tar.gz: 5b97d998e035e0c3a499ae89168f10b7e484cbf87ef551d16a11ddef1cf9d1f729b26a204d9cdabb7e1ea7b99de0e4322d9e71cba384c3d47ac0db85ccc2b8ac

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4]
+        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
     steps:
       - uses: actions/checkout@v3
 

data/CHANGES.txt

@@ -1,3 +1,11 @@
+=== 7.3.8
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
+=== 7.3.7
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 [#1063]
+
 === 7.3.6
 
   * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts since 7.3.4 [#1026, #1028]

data/Rakefile

@@ -9,7 +9,13 @@ require "rake"
 require "rake/clean"
 require "bundler/gem_tasks"
 
-require "rdoc/task"
+# rdoc is no longer a default gem as of Ruby 4.0; keep the rest of the
+# Rakefile usable when it is not installed.
+begin
+  require "rdoc/task"
+rescue LoadError
+  # rdoc tasks are optional
+end
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
 task :check_NET_SSH_BUILDGEM_SIGNED do
@@ -27,17 +33,19 @@ require_relative "lib/net/ssh/version"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.md'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exist?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
 end
 
 namespace :cert do

data/lib/net/ssh/proxy/jump.rb

@@ -35,28 +35,49 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          extra_jumps = jump_proxies.split(",", 2)[1]
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri, = jump_proxies.split(",").map { |jump| validate_jump!(jump) }
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
           template << " -F #{Shellwords.escape(config)}" if config != true && config
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
 
         private
 
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
         def validate_jump!(jump)
           uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
           validate_user_name!(uri.user) if uri.user
           validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
           uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
         end
       end
     end

data/lib/net/ssh/transport/session.rb

@@ -216,7 +216,8 @@ module Net
 
             else
               return packet if algorithms.allow?(packet)
-              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.initialized?
+              # Algorithms#rekey! clears initialized?, so the session id is what marks the first key exchange as done.
+              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.session_id
 
               push(packet)
             end

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 6
+      TINY  = 8
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/net-ssh.gemspec

@@ -30,6 +30,8 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency("logger")
+
   unless ENV['NET_SSH_NO_ED25519']
     spec.add_development_dependency("bcrypt_pbkdf", "~> 1.0") unless RUBY_PLATFORM == "java"
     spec.add_development_dependency("ed25519", "~> 1.2")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.6
+  version: 7.3.8
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,8 +32,22 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf
   requirement: !ruby/object:Gem::Requirement