net-ssh 7.3.8 → 7.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a32034e7f363bc87196ff8a13b8c79bd7e9b246e98375c8e8d505cd52ea0b19a
-  data.tar.gz: d98d516fa2ddc9a8e2718e60ea4367da99ae49b5082ec0b4897db24cc86a625f
+  metadata.gz: db3535a095da636205644f63d089fa686d964ad5adfda36d126e5ca39824f908
+  data.tar.gz: 9786dcb2366e2e7a745bb0635d0fd31d14878c5d994f71c00bfaf3f5c756e74a
 SHA512:
-  metadata.gz: d5d09d26af82a639bb793453e27f95b89cb1dbcc15a2bd22ccad8bc7e7106d848008927dbee29b5a8f7c280a15a5bd9eced464c45f004f0c1b64ee2bb1bb8eee
-  data.tar.gz: 5b97d998e035e0c3a499ae89168f10b7e484cbf87ef551d16a11ddef1cf9d1f729b26a204d9cdabb7e1ea7b99de0e4322d9e71cba384c3d47ac0db85ccc2b8ac
+  metadata.gz: bd1d6c6cb705aa0688a84eaa736e8032f9bda0ae5bf8a138d7b9bbd13a284e76440a5a3f7d37572026e4ab24bab2dac030b86ab522f532f54da32b724e619de6
+  data.tar.gz: 4c5f42af817e046a29302fc2555c16532c34e47f3dfb0e57a2357b7fae3ed67fe389c87313950fada4cbd6dda3f2857466bc1afd7c2316eaa072bfda1edb79ea

data/CHANGES.txt

@@ -1,3 +1,11 @@
+=== 7.3.10
+
+  * Security: verify the proxy's certificate and hostname in `Net::SSH::Proxy::HTTPS` by default, and the hostname with any verifying `:ssl_context`; any certificate was accepted, exposing the proxy credentials to a man-in-the-middle. A self-signed or private CA proxy now needs an `:ssl_context` that trusts it, or one with `verify_mode = OpenSSL::SSL::VERIFY_NONE` to skip verification. Thanks @fuzzyrichie [GHSA-qcf4-j55x-72hv]
+
+=== 7.3.9
+
+  * Security: refuse host keys marked `@revoked` in known_hosts, and certificates of such a key or signed by it, by raising the new `Net::SSH::HostKeyRevoked`, which `remember_host!` can't override; these lines were loaded as trusted keys, so every verifier except `:never` accepted the revoked key [GHSA-hjwv-j52r-xcg7]
+
 === 7.3.8
 
   * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]

data/lib/net/ssh/errors.rb

@@ -102,5 +102,15 @@ module Net
     # you want to proceed anyway, simply call the remember_host! method on the
     # exception, and then retry.
     class HostKeyUnknown < HostKeyError; end
+
+    # Raised when the key given by the host, or the CA that signed its
+    # certificate, is marked @revoked in a known hosts file. A revoked key must
+    # never be accepted, so unlike the other host key errors this one can't be
+    # overridden: #remember_host! just raises it again.
+    class HostKeyRevoked < HostKeyError
+      def remember_host!
+        raise self
+      end
+    end
   end
 end

data/lib/net/ssh/known_hosts.rb

@@ -93,6 +93,22 @@ module Net
           server_key.critical_options.empty?
         end
       end
+
+      # @revoked entry
+      class Revoked
+        def initialize(key, comment: nil)
+          @key = key
+          @comment = comment
+        end
+
+        # Returns true for the revoked key itself and for any certificate that
+        # wraps it or is signed by it, matching OpenSSH's check_key_not_revoked.
+        def matches_key?(server_key)
+          keys = [server_key]
+          keys += [server_key.key, server_key.signature_key] if server_key.respond_to?(:signature_key)
+          keys.any? { |key| key.ssh_type == @key.ssh_type && key.to_blob == @key.to_blob }
+        end
+      end
     end
 
     # Represents the result of a search in known hosts
@@ -101,11 +117,17 @@ module Net
       include Enumerable
       attr_reader :host
 
-      def initialize(host_keys, host, known_hosts, options = {})
+      def initialize(host_keys, host, known_hosts, options = {}, revoked_keys = [])
         @host_keys = host_keys
         @host = host
         @known_hosts = known_hosts
         @options = options
+        @revoked_keys = revoked_keys
+      end
+
+      # Returns true if a @revoked known-hosts entry for this host matches +key+.
+      def revoked?(key)
+        @revoked_keys.any? { |entry| entry.matches_key?(key) }
       end
 
       def add_host_key(key)
@@ -151,11 +173,14 @@ module Net
         # Searches all known host files (see KnownHosts.hostfiles) for all keys
         # of the given host. Returns an enumerable of keys found.
         def search_for(host, options = {})
-          HostKeys.new(search_in(hostfiles(options), host, options), host, self, options)
+          files = hostfiles(options)
+          revoked_keys = files.flat_map { |file| KnownHosts.new(file).revoked_keys_for(host) }
+          HostKeys.new(search_in(files, host, options), host, self, options, revoked_keys)
         end
 
         # Search for all known keys for the given host, in every file given in
-        # the +files+ array. Returns the list of keys.
+        # the +files+ array. Returns the list of keys. @revoked entries are not
+        # included.
         def search_in(files, host, options = {})
           files.flat_map { |file| KnownHosts.new(file).keys_for(host, options) }
         end
@@ -219,46 +244,50 @@ module Net
       #   "[net.ssh.test]:5555"
       #   "[1,2,3,4]:5555"
       #   "[net.ssh.test]:5555,[1.2.3.4]:5555
+      #
+      # @revoked entries are not included, see revoked_keys_for.
       def keys_for(host, options = {})
         keys = []
-        return keys unless File.readable?(source)
-
         entries = host.split(/,/)
         host_name = entries[0]
         host_ip = entries[1]
 
-        File.open(source) do |file|
-          file.each_line do |line|
-            if line.start_with?('@')
-              marker, hosts, type, key_content, comment = line.split(' ')
-            else
-              marker = nil
-              hosts, type, key_content, comment = line.split(' ')
-            end
+        each_entry do |marker, hostlist, key_content, comment|
+          next if marker == "@revoked"
 
-            # Skip empty line or one that is commented
-            next if hosts.nil? || hosts.start_with?('#')
+          found = hostlist.any? { |pattern| match(host_name, pattern) } || known_host_hash?(hostlist, entries)
+          next unless found
 
-            hostlist = hosts.split(',')
+          found = hostlist.include?(host_ip) if options[:check_host_ip] && entries.size > 1 && hostlist.size > 1
+          next unless found
 
-            next unless SUPPORTED_TYPE.include?(type)
+          raw_key = read_key(key_content)
+
+          keys <<
+            if marker == "@cert-authority"
+              HostKeyEntries::CertAuthority.new(raw_key, comment: comment)
+            else
+              HostKeyEntries::PubKey.new(raw_key, comment: comment)
+            end
+        end
 
-            found = hostlist.any? { |pattern| match(host_name, pattern) } || known_host_hash?(hostlist, entries)
-            next unless found
+        keys
+      end
 
-            found = hostlist.include?(host_ip) if options[:check_host_ip] && entries.size > 1 && hostlist.size > 1
-            next unless found
+      # Returns the @revoked entries for the given host, which takes the same
+      # formats as keys_for. An entry matching any of the comma-separated names
+      # counts, so :check_host_ip can't narrow a revocation.
+      def revoked_keys_for(host)
+        keys = []
+        entries = host.split(/,/)
 
-            blob = key_content.unpack("m*").first
-            raw_key = Net::SSH::Buffer.new(blob).read_key
+        each_entry do |marker, hostlist, key_content, comment|
+          next unless marker == "@revoked"
 
-            keys <<
-              if marker == "@cert-authority"
-                HostKeyEntries::CertAuthority.new(raw_key, comment: comment)
-              else
-                HostKeyEntries::PubKey.new(raw_key, comment: comment)
-              end
-          end
+          found = entries.any? { |entry| hostlist.any? { |pattern| match(entry, pattern) } }
+          next unless found || known_host_hash?(hostlist, entries)
+
+          keys << HostKeyEntries::Revoked.new(read_key(key_content), comment: comment)
         end
 
         keys
@@ -303,6 +332,32 @@ module Net
           file.puts "#{host} #{key.ssh_type} #{blob}"
         end
       end
+
+      private
+
+      # Yields the marker, host patterns, key and comment of each usable line.
+      def each_entry
+        return unless File.readable?(source)
+
+        File.open(source) do |file|
+          file.each_line do |line|
+            fields = line.split(' ')
+            marker = fields.shift if fields.first&.start_with?('@')
+            hosts, type, key_content, comment = fields
+
+            # Skip empty line or one that is commented
+            next if hosts.nil? || hosts.start_with?('#')
+
+            next unless SUPPORTED_TYPE.include?(type)
+
+            yield marker, hosts.split(','), key_content, comment
+          end
+        end
+      end
+
+      def read_key(key_content)
+        Net::SSH::Buffer.new(key_content.unpack("m*").first).read_key
+      end
     end
   end
 end

data/lib/net/ssh/proxy/https.rb

@@ -1,5 +1,6 @@
 require 'socket'
 require 'openssl'
+require 'resolv'
 require 'net/ssh/proxy/errors'
 require 'net/ssh/proxy/http'
 
@@ -15,10 +16,14 @@ module Net
         # can be used to tweak this proxy connection. In addition to the options
         # taken by Net::SSH::Proxy::HTTP it supports:
         #
-        # * :ssl_context => the SSL configuration to use for the connection
+        # * :ssl_context => the SSL configuration to use for the connection. The
+        #   default verifies the proxy's certificate and hostname against the
+        #   system trust store. For a self-signed or private CA certificate pass a
+        #   context with it in +cert_store+, or, to skip verification and expose
+        #   the proxy credentials to a man-in-the-middle, a context with
+        #   +verify_mode+ set to OpenSSL::SSL::VERIFY_NONE.
         def initialize(proxy_host, proxy_port = 80, options = {})
-          @ssl_context = options.delete(:ssl_context) ||
-                           OpenSSL::SSL::SSLContext.new
+          @ssl_context = options.delete(:ssl_context) || default_ssl_context
           super(proxy_host, proxy_port, options)
         end
 
@@ -41,9 +46,28 @@ module Net
           plain_socket = super(connect_timeout)
           OpenSSL::SSL::SSLSocket.new(plain_socket, @ssl_context).tap do |socket|
             socket.extend(SSLSocketCompatibility)
-            socket.connect
+            # SNI must not carry an IP address (RFC 6066).
+            socket.hostname = proxy_host unless Resolv::AddressRegex.match?(proxy_host)
+            begin
+              socket.connect
+              socket.post_connection_check(proxy_host) if verify_peer?
+            rescue StandardError
+              socket.close
+              raise
+            end
           end
         end
+
+        private
+
+        def default_ssl_context
+          OpenSSL::SSL::SSLContext.new.tap(&:set_params)
+        end
+
+        # verify_mode is nil on a bare SSLContext in older openssl gems.
+        def verify_peer?
+          @ssl_context.verify_mode.to_i != OpenSSL::SSL::VERIFY_NONE
+        end
       end
     end
   end

data/lib/net/ssh/verifiers/accept_new_or_local_tunnel.rb

@@ -7,11 +7,13 @@ module Net
       # verify a connection if the server is the localhost and the port is a
       # nonstandard port number. Those two conditions will typically mean the
       # connection is being tunnelled through a forwarded port, so the known-hosts
-      # file will not be helpful (in general).
+      # file will not be helpful (in general). A key marked @revoked is refused
+      # either way.
       class AcceptNewOrLocalTunnel < AcceptNew
         # Tries to determine if the connection is being tunnelled, and if so,
         # returns true. Otherwise, performs the standard strict verification.
         def verify(arguments)
+          refuse_revoked!(arguments)
           return true if tunnelled?(arguments)
 
           super

data/lib/net/ssh/verifiers/always.rb

@@ -10,10 +10,13 @@ module Net
       # (HostKeyUnknown). This is in contrast to the "Strict" class, which will
       # silently add the key to your known_hosts file. If the server does appear at
       # least once, but the key given does not match any known for the server, an
-      # exception will be raised (HostKeyMismatch).
+      # exception will be raised (HostKeyMismatch). A key marked @revoked in a
+      # host file is always refused (HostKeyRevoked).
       # Otherwise, this returns true.
       class Always
         def verify(arguments)
+          refuse_revoked!(arguments)
+
           host_keys = arguments[:session].host_keys
 
           # We've never seen this host before, so raise an exception.
@@ -47,6 +50,18 @@ module Net
 
         private
 
+        # Custom :known_hosts objects may return a host_keys collection with no
+        # revocation support.
+        def refuse_revoked!(arguments)
+          host_keys = arguments[:session].host_keys
+          return unless host_keys.respond_to?(:revoked?) && host_keys.revoked?(arguments[:key])
+
+          exception = HostKeyRevoked.new("fingerprint #{arguments[:fingerprint]} " +
+                                         "is revoked for #{host_keys.host.inspect}")
+          exception.data = arguments
+          raise exception
+        end
+
         # Enforces the @cert-authority certificate constraints for entries that
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.

data/lib/net/ssh/verifiers/never.rb

@@ -3,7 +3,8 @@ module Net
     module Verifiers
       # This host key verifier simply allows every key it sees, without
       # any verification. This is simple, but very insecure because it
-      # exposes you to MiTM attacks.
+      # exposes you to MiTM attacks. It does not read the known hosts files,
+      # so it accepts keys marked @revoked as well.
       class Never
         # Returns true.
         def verify(arguments)

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 8
+      TINY  = 10
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.8
+  version: 7.3.10
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-25 00:00:00.000000000 Z
+date: 2026-11-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger