X2Go Bug report logs - #1429
Tilde expansion no longer performed by libssh after CVE-2019-14889

version graph

Package: x2goclient; Maintainer for x2goclient is X2Go Developers <x2go-dev@lists.x2go.org>; Source for x2goclient is src:x2goclient.

Reported by: Sylvain Cuaz <sylvain@ilm-informatique.fr>

Date: Fri, 20 Dec 2019 17:25:01 UTC

Severity: normal

Tags: pending

Merged with 1428

Found in version 4.1.2.1

Fixed in version 4.1.2.2

Done: X2Go Release Manager X2Go Release Manager <git-admin@x2go.org>

Bug is archived. No further changes may be made.

Full log

Message #23 received at 1429@bugs.x2go.org (full text, mbox, reply):

Received: (at 1429) by bugs.x2go.org; 20 Dec 2019 20:44:13 +0000
From sylvain@ilm-informatique.fr  Fri Dec 20 21:44:11 2019
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=3.0 tests=BAYES_00,RCVD_IN_MSPIKE_H3,
	RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham
	autolearn_force=no version=3.4.2
Received: from 20.mo6.mail-out.ovh.net (20.mo6.mail-out.ovh.net [178.32.124.17])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 5D8695DAE7
	for <1429@bugs.x2go.org>; Fri, 20 Dec 2019 21:44:10 +0100 (CET)
Received: from player711.ha.ovh.net (unknown [10.108.16.182])
	by mo6.mail-out.ovh.net (Postfix) with ESMTP id 06DB01F5DD9
	for <1429@bugs.x2go.org>; Fri, 20 Dec 2019 21:44:09 +0100 (CET)
Received: from ilm-informatique.fr (38.233.153.77.rev.sfr.net [77.153.233.38])
	(Authenticated sender: sylvain@ilm-informatique.fr)
	by player711.ha.ovh.net (Postfix) with ESMTPSA id 5D141D6EFA39;
	Fri, 20 Dec 2019 20:44:08 +0000 (UTC)
Subject: Re: [X2Go-Dev] Bug#1429: Tilde expansion no longer performed by
 libssh after CVE-2019-14889
To: Mihai Moldovan <ionic@ionic.de>, 1429@bugs.x2go.org
References: <cd6dd615-289f-6914-7668-9190b8aca97e@ilm-informatique.fr>
 <5c04ddf5-0cb9-eff2-0346-d37115f7c07e@ionic.de>
From: Sylvain Cuaz <sylvain@ilm-informatique.fr>
Message-ID: <b882be92-77f8-50fb-15d0-4209418782d2@ilm-informatique.fr>
Date: Fri, 20 Dec 2019 21:44:07 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.2.2
MIME-Version: 1.0
In-Reply-To: <5c04ddf5-0cb9-eff2-0346-d37115f7c07e@ionic.de>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: fr
X-Ovh-Tracer-Id: 3645945377423568677
X-VR-SPAMSTATE: OK
X-VR-SPAMSCORE: 0
X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedufedrvddufedgudefkecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemucehtddtnecunecujfgurhepuffvfhfhkffffgggjggtgfesthekredttdefjeenucfhrhhomhepufihlhhvrghinhcuvehurgiiuceoshihlhhvrghinhesihhlmhdqihhnfhhorhhmrghtihhquhgvrdhfrheqnecuffhomhgrihhnpehusghunhhtuhdrtghomhdplhhisghsshhhrdhorhhgnecukfhppedtrddtrddtrddtpdejjedrudehfedrvdeffedrfeeknecurfgrrhgrmhepmhhouggvpehsmhhtphdqohhuthdphhgvlhhopehplhgrhigvrhejuddurdhhrgdrohhvhhdrnhgvthdpihhnvghtpedtrddtrddtrddtpdhmrghilhhfrhhomhepshihlhhvrghinhesihhlmhdqihhnfhhorhhmrghtihhquhgvrdhfrhdprhgtphhtthhopedugedvleessghughhsrdigvdhgohdrohhrghenucevlhhushhtvghrufhiiigvpedt

Le 20/12/2019 à 19:06, Mihai Moldovan a écrit :
> Control: reassign -1 x2goclient 4.1.2.1
> Control: forcemerge -1 1428
>
> * On 12/20/19 6:21 PM, Sylvain Cuaz wrote:
>> SSH key fails to be copied to the remote side because the path use a tilde, so neither file sharing nor client-side printing works.
>> [...]
>> After using gdb I saw that ONMainWindow::exportDirs() calls SshMasterConnection::copyFile() with dst="~"+uname +"/.x2go/ssh/"+dst;
>> which is ultimately passed to libssh. But following CVE-2019-14889 the path is now literal (quoted), see
>> https://git.libssh.org/projects/libssh.git/log/src/scp.c for the libssh logs and
>> https://usn.ubuntu.com/4219-1/ for the ubuntu packages
> Yes, I think that this change has been intentional. I'll have to fix that in
> X2Go Client and I know how to do this easily to retain support for pre-patched
> and patched versions.
>
> I will, however, probably not be able to provide new release versions with that
> fix (and others) for about a months.
>
> I'll let you know when fixed nightly versions are available, though.

OK thanks

>> As a workaround I reinstalled an old version of the libssh-4 package and the bug went away.
> Please don't do that OR recommend that. You're essentially now running without
> the CVE fix, which is probably worse than a broken client.

Yes, 'workaround' was not the right word. I meant while investigating to confirm my findings.

Send a report that this bug log contains spam.

X2Go Developers <owner@bugs.x2go.org>. Last modified: Fri Apr 26 13:14:38 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.