net-ssh 8.1.1 → 8.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 07eacca644427ed0543e1a428d7075c1d5fd4a0da378e83959dcd312cd7f3500
-  data.tar.gz: eb50984faecccca334a68cd2b8fc04a749010e85e3cad2acb5e868b44bd168e6
+  metadata.gz: 66339496243d9984d49aeebce869255bb936e533280674b6a7aaf9de33381cfa
+  data.tar.gz: f2492cf09d1396dac5731fed8bd5b9def374d7900e30e5c03a7fcf00986bad05
 SHA512:
-  metadata.gz: 0eab425719d3294df5ece8aff6758c4a627a67b366b661d1a4475b9979c5dea5e614ab583f559fd3a4d36ccd7d8f0cb35776e99a955007830a6ed0b3b37c04bb
-  data.tar.gz: 4c5a4eaeff4882604a01156bf22322d81c864f26b0637cb0400554206c514aa137a00f9b83ed637001a7ffb4ef599d49d512862963b1dd1041db6886dae44754
+  metadata.gz: 54534ecfdc1ef2b0ae192fbdfee3255021100e182c8bec06d48b03d2ea7c669dfa8d626b724d2ccd1f99a3743956196242c13941c39e2363a33c24b2691dce22
+  data.tar.gz: c0c8bbc852f0ebc46f223668592a5b78484aa816ade2923f56f59552653fa893f683b2fe408ba9f19fc3391bc8d200bfcf90f12384d3bec812cbd62a776f5c1d

data/CHANGES.txt

@@ -1,3 +1,7 @@
+=== 8.1.2
+
+  * Security: verify the proxy's certificate and hostname in `Net::SSH::Proxy::HTTPS` by default, and the hostname with any verifying `:ssl_context`; any certificate was accepted, exposing the proxy credentials to a man-in-the-middle. A self-signed or private CA proxy now needs an `:ssl_context` that trusts it, or one with `verify_mode = OpenSSL::SSL::VERIFY_NONE` to skip verification. Thanks @fuzzyrichie [GHSA-qcf4-j55x-72hv]
+
 === 8.1.1
 
   * Security: refuse host keys marked `@revoked` in known_hosts, and certificates of such a key or signed by it, by raising the new `Net::SSH::HostKeyRevoked`, which `remember_host!` can't override; these lines were loaded as trusted keys, so every verifier except `:never` accepted the revoked key [GHSA-hjwv-j52r-xcg7]

data/lib/net/ssh/proxy/https.rb

@@ -1,5 +1,6 @@
 require 'socket'
 require 'openssl'
+require 'resolv'
 require 'net/ssh/proxy/errors'
 require 'net/ssh/proxy/http'
 
@@ -15,10 +16,14 @@ module Net
         # can be used to tweak this proxy connection. In addition to the options
         # taken by Net::SSH::Proxy::HTTP it supports:
         #
-        # * :ssl_context => the SSL configuration to use for the connection
+        # * :ssl_context => the SSL configuration to use for the connection. The
+        #   default verifies the proxy's certificate and hostname against the
+        #   system trust store. For a self-signed or private CA certificate pass a
+        #   context with it in +cert_store+, or, to skip verification and expose
+        #   the proxy credentials to a man-in-the-middle, a context with
+        #   +verify_mode+ set to OpenSSL::SSL::VERIFY_NONE.
         def initialize(proxy_host, proxy_port = 80, options = {})
-          @ssl_context = options.delete(:ssl_context) ||
-                           OpenSSL::SSL::SSLContext.new
+          @ssl_context = options.delete(:ssl_context) || default_ssl_context
           super(proxy_host, proxy_port, options)
         end
 
@@ -41,9 +46,28 @@ module Net
           plain_socket = super(connect_timeout)
           OpenSSL::SSL::SSLSocket.new(plain_socket, @ssl_context).tap do |socket|
             socket.extend(SSLSocketCompatibility)
-            socket.connect
+            # SNI must not carry an IP address (RFC 6066).
+            socket.hostname = proxy_host unless Resolv::AddressRegex.match?(proxy_host)
+            begin
+              socket.connect
+              socket.post_connection_check(proxy_host) if verify_peer?
+            rescue StandardError
+              socket.close
+              raise
+            end
           end
         end
+
+        private
+
+        def default_ssl_context
+          OpenSSL::SSL::SSLContext.new.tap(&:set_params)
+        end
+
+        # verify_mode is nil on a bare SSLContext in older openssl gems.
+        def verify_peer?
+          @ssl_context.verify_mode.to_i != OpenSSL::SSL::VERIFY_NONE
+        end
       end
     end
   end

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 1
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 1
+      TINY  = 2
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.1.1
+  version: 8.1.2
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-11-06 00:00:00.000000000 Z
+date: 2026-11-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger

metadata.gz.sig

@@ -1 +1,2 @@
-����K�#��إ�TJ�q�3v|�6e`�gI;f�s�"O)�R��/�?��
+5SV(��_��]��YoD.h����L��%��cOD�`�:�g��_�4�$xt�D0�M��/��/���}��2��E@9.<��A��b�ɪI�⋕?M��5IO��ފ�L�[�,���:�Z�߮
+���5@�Sq�1j�E���*8�_�ڑd�xe3h�ɂEg�%؛d�#�t��}N����$������