net-ssh 7.3.7 → 7.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20d1aa171eb7f2135e994d7d7c495400ad619159a0d67a287336466512f43dec
-  data.tar.gz: acaf01c452aab18fc52d7994295d6ca4c843065d0d1044d1fa86e0f9ba542db5
+  metadata.gz: a32034e7f363bc87196ff8a13b8c79bd7e9b246e98375c8e8d505cd52ea0b19a
+  data.tar.gz: d98d516fa2ddc9a8e2718e60ea4367da99ae49b5082ec0b4897db24cc86a625f
 SHA512:
-  metadata.gz: 570ef6dcb8286b230c8e97b41bd6efa2d0358effee0b55e23de2d6392785d71dd220f0d39bd90e232a7a84ebfe97ddbcb0a9bfa6263e3c180a5a3fed894ceac8
-  data.tar.gz: f7c2f6c2eec63eab80e632d459b8f4c424cefea276077ad484fa1b0eb94489a86fc6b620e682100e4f5d9dba89df39e3f50384019d136ef6cbf0bf52f6fbb800
+  metadata.gz: d5d09d26af82a639bb793453e27f95b89cb1dbcc15a2bd22ccad8bc7e7106d848008927dbee29b5a8f7c280a15a5bd9eced464c45f004f0c1b64ee2bb1bb8eee
+  data.tar.gz: 5b97d998e035e0c3a499ae89168f10b7e484cbf87ef551d16a11ddef1cf9d1f729b26a204d9cdabb7e1ea7b99de0e4322d9e71cba384c3d47ac0db85ccc2b8ac

data/CHANGES.txt

@@ -1,3 +1,7 @@
+=== 7.3.8
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
 === 7.3.7
 
   * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 [#1063]

data/lib/net/ssh/proxy/jump.rb

@@ -35,28 +35,49 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          extra_jumps = jump_proxies.split(",", 2)[1]
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri, = jump_proxies.split(",").map { |jump| validate_jump!(jump) }
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
           template << " -F #{Shellwords.escape(config)}" if config != true && config
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
 
         private
 
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
         def validate_jump!(jump)
           uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
           validate_user_name!(uri.user) if uri.user
           validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
           uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
         end
       end
     end

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 7
+      TINY  = 8
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.7
+  version: 7.3.8
 platform: ruby
 authors:
 - Jamis Buck

metadata.gz.sig

@@ -1 +1 @@
-
+`WL�,�r_t�|ͧ�'���dJ|W�dYO�7Y;R�d�<9/b(�z؝0mF��7Z7d��}���V���m��
�-��(�u��$p�]���Uf��Nq�ʂ�yW�>���(i������?7���2<�̂��
9j井�s�V�:>%�k=��xt���$�