net-ssh 7.3.7 → 7.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20d1aa171eb7f2135e994d7d7c495400ad619159a0d67a287336466512f43dec
-  data.tar.gz: acaf01c452aab18fc52d7994295d6ca4c843065d0d1044d1fa86e0f9ba542db5
+  metadata.gz: b3711427d13347329810ecb931a8b67d7a4166364df280fd3c9bb98f80e6b79c
+  data.tar.gz: 367a9ff71b98dfc29aeed8b0fe11156b469d25d51c835e93c25366d0860df5c6
 SHA512:
-  metadata.gz: 570ef6dcb8286b230c8e97b41bd6efa2d0358effee0b55e23de2d6392785d71dd220f0d39bd90e232a7a84ebfe97ddbcb0a9bfa6263e3c180a5a3fed894ceac8
-  data.tar.gz: f7c2f6c2eec63eab80e632d459b8f4c424cefea276077ad484fa1b0eb94489a86fc6b620e682100e4f5d9dba89df39e3f50384019d136ef6cbf0bf52f6fbb800
+  metadata.gz: 3adc06b15596a5d708cfd206ec5efb91461de3458042da6e3eff25496e0f249cd4070197e393ce674b1dc40feb4862e643da4c70790af2be76321f74744974ea
+  data.tar.gz: 9d419e3dfadede74db2b04a897185aa36bcc3e84c52479e9ae0be06275fb497c9080cd209419171205d5a5f8c5b7beed001cd94322c8427c35759de67433bed0

data/CHANGES.txt

@@ -1,3 +1,11 @@
+=== 7.3.9
+
+  * Security: refuse host keys marked `@revoked` in known_hosts, and certificates of such a key or signed by it, by raising the new `Net::SSH::HostKeyRevoked`, which `remember_host!` can't override; these lines were loaded as trusted keys, so every verifier except `:never` accepted the revoked key [GHSA-hjwv-j52r-xcg7]
+
+=== 7.3.8
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
 === 7.3.7
 
   * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 [#1063]

data/lib/net/ssh/errors.rb

@@ -102,5 +102,15 @@ module Net
     # you want to proceed anyway, simply call the remember_host! method on the
     # exception, and then retry.
     class HostKeyUnknown < HostKeyError; end
+
+    # Raised when the key given by the host, or the CA that signed its
+    # certificate, is marked @revoked in a known hosts file. A revoked key must
+    # never be accepted, so unlike the other host key errors this one can't be
+    # overridden: #remember_host! just raises it again.
+    class HostKeyRevoked < HostKeyError
+      def remember_host!
+        raise self
+      end
+    end
   end
 end

data/lib/net/ssh/known_hosts.rb

@@ -93,6 +93,22 @@ module Net
           server_key.critical_options.empty?
         end
       end
+
+      # @revoked entry
+      class Revoked
+        def initialize(key, comment: nil)
+          @key = key
+          @comment = comment
+        end
+
+        # Returns true for the revoked key itself and for any certificate that
+        # wraps it or is signed by it, matching OpenSSH's check_key_not_revoked.
+        def matches_key?(server_key)
+          keys = [server_key]
+          keys += [server_key.key, server_key.signature_key] if server_key.respond_to?(:signature_key)
+          keys.any? { |key| key.ssh_type == @key.ssh_type && key.to_blob == @key.to_blob }
+        end
+      end
     end
 
     # Represents the result of a search in known hosts
@@ -101,11 +117,17 @@ module Net
       include Enumerable
       attr_reader :host
 
-      def initialize(host_keys, host, known_hosts, options = {})
+      def initialize(host_keys, host, known_hosts, options = {}, revoked_keys = [])
         @host_keys = host_keys
         @host = host
         @known_hosts = known_hosts
         @options = options
+        @revoked_keys = revoked_keys
+      end
+
+      # Returns true if a @revoked known-hosts entry for this host matches +key+.
+      def revoked?(key)
+        @revoked_keys.any? { |entry| entry.matches_key?(key) }
       end
 
       def add_host_key(key)
@@ -151,11 +173,14 @@ module Net
         # Searches all known host files (see KnownHosts.hostfiles) for all keys
         # of the given host. Returns an enumerable of keys found.
         def search_for(host, options = {})
-          HostKeys.new(search_in(hostfiles(options), host, options), host, self, options)
+          files = hostfiles(options)
+          revoked_keys = files.flat_map { |file| KnownHosts.new(file).revoked_keys_for(host) }
+          HostKeys.new(search_in(files, host, options), host, self, options, revoked_keys)
         end
 
         # Search for all known keys for the given host, in every file given in
-        # the +files+ array. Returns the list of keys.
+        # the +files+ array. Returns the list of keys. @revoked entries are not
+        # included.
         def search_in(files, host, options = {})
           files.flat_map { |file| KnownHosts.new(file).keys_for(host, options) }
         end
@@ -219,46 +244,50 @@ module Net
       #   "[net.ssh.test]:5555"
       #   "[1,2,3,4]:5555"
       #   "[net.ssh.test]:5555,[1.2.3.4]:5555
+      #
+      # @revoked entries are not included, see revoked_keys_for.
       def keys_for(host, options = {})
         keys = []
-        return keys unless File.readable?(source)
-
         entries = host.split(/,/)
         host_name = entries[0]
         host_ip = entries[1]
 
-        File.open(source) do |file|
-          file.each_line do |line|
-            if line.start_with?('@')
-              marker, hosts, type, key_content, comment = line.split(' ')
-            else
-              marker = nil
-              hosts, type, key_content, comment = line.split(' ')
-            end
+        each_entry do |marker, hostlist, key_content, comment|
+          next if marker == "@revoked"
 
-            # Skip empty line or one that is commented
-            next if hosts.nil? || hosts.start_with?('#')
+          found = hostlist.any? { |pattern| match(host_name, pattern) } || known_host_hash?(hostlist, entries)
+          next unless found
 
-            hostlist = hosts.split(',')
+          found = hostlist.include?(host_ip) if options[:check_host_ip] && entries.size > 1 && hostlist.size > 1
+          next unless found
 
-            next unless SUPPORTED_TYPE.include?(type)
+          raw_key = read_key(key_content)
+
+          keys <<
+            if marker == "@cert-authority"
+              HostKeyEntries::CertAuthority.new(raw_key, comment: comment)
+            else
+              HostKeyEntries::PubKey.new(raw_key, comment: comment)
+            end
+        end
 
-            found = hostlist.any? { |pattern| match(host_name, pattern) } || known_host_hash?(hostlist, entries)
-            next unless found
+        keys
+      end
 
-            found = hostlist.include?(host_ip) if options[:check_host_ip] && entries.size > 1 && hostlist.size > 1
-            next unless found
+      # Returns the @revoked entries for the given host, which takes the same
+      # formats as keys_for. An entry matching any of the comma-separated names
+      # counts, so :check_host_ip can't narrow a revocation.
+      def revoked_keys_for(host)
+        keys = []
+        entries = host.split(/,/)
 
-            blob = key_content.unpack("m*").first
-            raw_key = Net::SSH::Buffer.new(blob).read_key
+        each_entry do |marker, hostlist, key_content, comment|
+          next unless marker == "@revoked"
 
-            keys <<
-              if marker == "@cert-authority"
-                HostKeyEntries::CertAuthority.new(raw_key, comment: comment)
-              else
-                HostKeyEntries::PubKey.new(raw_key, comment: comment)
-              end
-          end
+          found = entries.any? { |entry| hostlist.any? { |pattern| match(entry, pattern) } }
+          next unless found || known_host_hash?(hostlist, entries)
+
+          keys << HostKeyEntries::Revoked.new(read_key(key_content), comment: comment)
         end
 
         keys
@@ -303,6 +332,32 @@ module Net
           file.puts "#{host} #{key.ssh_type} #{blob}"
         end
       end
+
+      private
+
+      # Yields the marker, host patterns, key and comment of each usable line.
+      def each_entry
+        return unless File.readable?(source)
+
+        File.open(source) do |file|
+          file.each_line do |line|
+            fields = line.split(' ')
+            marker = fields.shift if fields.first&.start_with?('@')
+            hosts, type, key_content, comment = fields
+
+            # Skip empty line or one that is commented
+            next if hosts.nil? || hosts.start_with?('#')
+
+            next unless SUPPORTED_TYPE.include?(type)
+
+            yield marker, hosts.split(','), key_content, comment
+          end
+        end
+      end
+
+      def read_key(key_content)
+        Net::SSH::Buffer.new(key_content.unpack("m*").first).read_key
+      end
     end
   end
 end

data/lib/net/ssh/proxy/jump.rb

@@ -35,28 +35,49 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          extra_jumps = jump_proxies.split(",", 2)[1]
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri, = jump_proxies.split(",").map { |jump| validate_jump!(jump) }
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
           template << " -F #{Shellwords.escape(config)}" if config != true && config
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
 
         private
 
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
         def validate_jump!(jump)
           uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
           validate_user_name!(uri.user) if uri.user
           validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
           uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
         end
       end
     end

data/lib/net/ssh/verifiers/accept_new_or_local_tunnel.rb

@@ -7,11 +7,13 @@ module Net
       # verify a connection if the server is the localhost and the port is a
       # nonstandard port number. Those two conditions will typically mean the
       # connection is being tunnelled through a forwarded port, so the known-hosts
-      # file will not be helpful (in general).
+      # file will not be helpful (in general). A key marked @revoked is refused
+      # either way.
       class AcceptNewOrLocalTunnel < AcceptNew
         # Tries to determine if the connection is being tunnelled, and if so,
         # returns true. Otherwise, performs the standard strict verification.
         def verify(arguments)
+          refuse_revoked!(arguments)
           return true if tunnelled?(arguments)
 
           super

data/lib/net/ssh/verifiers/always.rb

@@ -10,10 +10,13 @@ module Net
       # (HostKeyUnknown). This is in contrast to the "Strict" class, which will
       # silently add the key to your known_hosts file. If the server does appear at
       # least once, but the key given does not match any known for the server, an
-      # exception will be raised (HostKeyMismatch).
+      # exception will be raised (HostKeyMismatch). A key marked @revoked in a
+      # host file is always refused (HostKeyRevoked).
       # Otherwise, this returns true.
       class Always
         def verify(arguments)
+          refuse_revoked!(arguments)
+
           host_keys = arguments[:session].host_keys
 
           # We've never seen this host before, so raise an exception.
@@ -47,6 +50,18 @@ module Net
 
         private
 
+        # Custom :known_hosts objects may return a host_keys collection with no
+        # revocation support.
+        def refuse_revoked!(arguments)
+          host_keys = arguments[:session].host_keys
+          return unless host_keys.respond_to?(:revoked?) && host_keys.revoked?(arguments[:key])
+
+          exception = HostKeyRevoked.new("fingerprint #{arguments[:fingerprint]} " +
+                                         "is revoked for #{host_keys.host.inspect}")
+          exception.data = arguments
+          raise exception
+        end
+
         # Enforces the @cert-authority certificate constraints for entries that
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.

data/lib/net/ssh/verifiers/never.rb

@@ -3,7 +3,8 @@ module Net
     module Verifiers
       # This host key verifier simply allows every key it sees, without
       # any verification. This is simple, but very insecure because it
-      # exposes you to MiTM attacks.
+      # exposes you to MiTM attacks. It does not read the known hosts files,
+      # so it accepts keys marked @revoked as well.
       class Never
         # Returns true.
         def verify(arguments)

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 7
+      TINY  = 9
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.7
+  version: 7.3.9
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-25 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger