Subject: Tilde expansion no longer performed by libssh after CVE-2019-14889

From: Sylvain Cuaz <[email-masked]>
Date: Fri, 20 Dec 2019 18:21:24 +0100

Package: x2goclient
Version: 4.1.1.1

SSH key fails to be copied to the remote side because the path use a tilde, so neither file sharing nor client-side printing works.

Client OS Ubuntu 18.04.3 LTS with libssh-4 0.8.0~20170825.94fa1e38-1ubuntu0.5
Server OS Ubuntu 16.04.6 LTS

Since december, 10th on Ubuntu, every time I connect to a server with either file sharing or printing enabled I have this error message :
"Cannot create remote file ~ilm/.x2go/ssh/key.jdT502" - "SCP: Warning: status code 1 received: scp: ~ilm/.x2go/ssh: No such file or directory\n"
But the directory does exist.

After using gdb I saw that ONMainWindow::exportDirs() calls SshMasterConnection::copyFile() with dst="~"+uname +"/.x2go/ssh/"+dst;
which is ultimately passed to libssh. But following CVE-2019-14889 the path is now literal (quoted), see
https://git.libssh.org/projects/libssh.git/log/src/scp.c for the libssh logs and
https://usn.ubuntu.com/4219-1/ for the ubuntu packages

A similar issue is handled for Windows in SshProcess::start_cp()

As a workaround I reinstalled an old version of the libssh-4 package and the bug went away.