From: Kai Kang <kai.k...@windriver.com> Backport patch to fix CVE-2021-36370.
CVE: CVE-2021-36370 Signed-off-by: Kai Kang <kai.k...@windriver.com> --- .../mc/files/CVE-2021-36370.patch | 609 ++++++++++++++++++ meta/recipes-extended/mc/mc_4.8.26.bb | 1 + 2 files changed, 610 insertions(+) create mode 100644 meta/recipes-extended/mc/files/CVE-2021-36370.patch diff --git a/meta/recipes-extended/mc/files/CVE-2021-36370.patch b/meta/recipes-extended/mc/files/CVE-2021-36370.patch new file mode 100644 index 0000000000..d6a26871bd --- /dev/null +++ b/meta/recipes-extended/mc/files/CVE-2021-36370.patch @@ -0,0 +1,609 @@ +Backport patch to fix CVE-2021-36370. + +Upstream-Status: Backport [https://github.com/MidnightCommander/mc/commit/9235d3c] +CVE: CVE-2021-36370 + +Signed-off-by: Kai Kang <kai.k...@windriver.com> + +From 9235d3c232d13ad7f973346077c9cf2eaa77dc5f Mon Sep 17 00:00:00 2001 +From: Andrew Borodin <aboro...@vmail.ru> +Date: Mon, 12 Jul 2021 08:48:18 +0300 +Subject: [PATCH] SFTPFS: verify server fingerprint (fix CVE-2021-36370). + +Use ~/.ssh/known_hosts file to verify server fingerprint +using ssh way: + +$ ssh localhost +The authenticity of host 'localhost (127.0.0.1)' can't be established. +ED25519 key fingerprint is SHA256:FzqKTNTroFuNUj1wUzSeV2x/1lpcESnT0ZRCmq5H6o8. +Are you sure you want to continue connecting (yes/no)? no +ssh: Host key verification failed. + +$ ssh localhost +The authenticity of host 'localhost (127.0.0.1)' can't be established. +ED25519 key fingerprint is SHA256:FzqKTNTroFuNUj1wUzSeV2x/1lpcESnT0ZRCmq5H6o8. +Are you sure you want to continue connecting (yes/no)? yes +Warning: Permanently added 'localhost' (ED25519) to the list of known hosts. +andrew@localhost's password: + +Thanks the Curl project for the used code. + +Signed-off-by: Andrew Borodin <aboro...@vmail.ru> +Signed-off-by: Yury V. Zaytsev <yury.zayt...@moneymeets.com> +--- + doc/man/mc.1.in | 15 ++ + doc/man/ru/mc.1.in | 14 ++ + src/vfs/sftpfs/connection.c | 428 +++++++++++++++++++++++++++++++++++- + src/vfs/sftpfs/internal.h | 5 +- + 4 files changed, 452 insertions(+), 10 deletions(-) + +diff --git a/doc/man/mc.1.in b/doc/man/mc.1.in +index c0c06e32f7..7a3d118384 100644 +--- a/doc/man/mc.1.in ++++ b/doc/man/mc.1.in +@@ -3364,6 +3364,21 @@ Examples: + sftp://j...@noncompressed.ssh.edu/private + sftp://j...@somehost.ssh.edu:2222/private + .fi ++.PP ++When establishing the connection, server key fingerprint is verified using ++the ~/.ssh/known_hosts file. If the host/key pair is not found or the host is found, ++but the key doesn't match, an appropriate message is shown. ++There are three buttons in the message dialog: ++.PP ++.B [Yes] ++add new host/key pair to the ~/.ssh/known_hosts file and continue. ++.PP ++.B [Ignore] ++do not add new host/key pair to the ~/.ssh/known_hosts file, but continue ++nevertheless (at you own risk). ++.PP ++.B [No] ++abort connection. + .\"NODE " Undelete File System" + .SH " Undelete File System" + On Linux systems, if you asked configure to use the ext2fs undelete +diff --git a/doc/man/ru/mc.1.in b/doc/man/ru/mc.1.in +index 7609da1127..bc0c1810a9 100644 +--- a/doc/man/ru/mc.1.in ++++ b/doc/man/ru/mc.1.in +@@ -3874,6 +3874,20 @@ bash\-совместимая оболочка shell. + sftp://j...@noncompressed.ssh.edu/private + sftp://j...@somehost.ssh.edu:2222/private + .fi ++При установлении соединения происходит проверка ключа сервера с использованием ++файла ~/.ssh/known_hosts file. Если пара сервер/ключ в этом файле не найдена ++или сервер найден, но ключ не соответствует, пользователю показывается ++окно с соответствующим сообщением, содержащее три кнопки: ++.PP ++.B [Да] ++добавить новую пару сервер/ключ в файл ~/.ssh/known_hosts и продолжить соединение. ++.PP ++.B [Игнорировать] ++не добавлять новую пару сервер/ключ в файл ~/.ssh/known_hosts и всё равно ++продолжить соединение (на свой страх и риск). ++.PP ++.B [Нет] ++прервать соединение. + .\"NODE " Undelete File System" + .SH " Файловая система UFS (Undelete File System)" + В ОС Linux можно сконфигурировать файловую систему ext2fs, используемую +diff --git a/src/vfs/sftpfs/connection.c b/src/vfs/sftpfs/connection.c +index 9f8ea5633b..acd5026515 100644 +--- a/src/vfs/sftpfs/connection.c ++++ b/src/vfs/sftpfs/connection.c +@@ -42,6 +42,8 @@ + #include "lib/util.h" + #include "lib/tty/tty.h" /* tty_enable_interrupt_key () */ + #include "lib/vfs/utilvfs.h" ++#include "lib/mcconfig.h" /* mc_config_get_home_dir () */ ++#include "lib/widget.h" /* query_dialog () */ + + #include "internal.h" + +@@ -49,10 +51,37 @@ + + /*** file scope macro definitions ****************************************************************/ + ++#define SHA1_DIGEST_LENGTH 20 ++ + /*** file scope type declarations ****************************************************************/ + + /*** file scope variables ************************************************************************/ + ++#ifdef LIBSSH2_KNOWNHOST_KEY_ED25519 ++static const char *const hostkey_method_ssh_ed25519 = "ssh-ed25519"; ++#endif ++#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_521 ++static const char *const hostkey_method_ssh_ecdsa_521 = "ecdsa-sha2-nistp521"; ++#endif ++#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_384 ++static const char *const hostkey_method_ssh_ecdsa_384 = "ecdsa-sha2-nistp384"; ++#endif ++#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_256 ++static const char *const hostkey_method_ssh_ecdsa_256 = "ecdsa-sha2-nistp256"; ++#endif ++static const char *const hostkey_method_ssh_rsa = "ssh-rsa"; ++static const char *const hostkey_method_ssh_dss = "ssh-dss"; ++ ++/** ++ * ++ * The current implementation of know host key checking has following limitations: ++ * ++ * - Only plain-text entries are supported (`HashKnownHosts no` OpenSSH option) ++ * - Only HEX-encoded SHA1 fingerprint display is supported (`FingerprintHash` OpenSSH option) ++ * - Resolved IP addresses are *not* saved/validated along with the hostnames ++ * ++ */ ++ + static const char *kbi_passwd = NULL; + static const struct vfs_s_super *kbi_super = NULL; + +@@ -70,9 +99,12 @@ static const struct vfs_s_super *kbi_super = NULL; + static int + sftpfs_open_socket (struct vfs_s_super *super, GError ** mcerror) + { ++ sftpfs_super_t *sftpfs_super = SFTP_SUPER (super); + struct addrinfo hints, *res = NULL, *curr_res; + int my_socket = 0; + char port[BUF_TINY]; ++ static char address_ipv4[INET_ADDRSTRLEN]; ++ static char address_ipv6[INET6_ADDRSTRLEN]; + int e; + + mc_return_val_if_error (mcerror, LIBSSH2_INVALID_SOCKET); +@@ -120,6 +152,30 @@ sftpfs_open_socket (struct vfs_s_super *super, GError ** mcerror) + { + int save_errno; + ++ switch (curr_res->ai_addr->sa_family) ++ { ++ case AF_INET: ++ sftpfs_super->ip_address = ++ inet_ntop (AF_INET, &((struct sockaddr_in *) curr_res->ai_addr)->sin_addr, ++ address_ipv4, INET_ADDRSTRLEN); ++ break; ++ case AF_INET6: ++ sftpfs_super->ip_address = ++ inet_ntop (AF_INET6, &((struct sockaddr_in6 *) curr_res->ai_addr)->sin6_addr, ++ address_ipv6, INET6_ADDRSTRLEN); ++ break; ++ default: ++ sftpfs_super->ip_address = NULL; ++ } ++ ++ if (sftpfs_super->ip_address == NULL) ++ { ++ mc_propagate_error (mcerror, 0, "%s", ++ _("sftp: failed to convert remote host IP address into text form")); ++ my_socket = LIBSSH2_INVALID_SOCKET; ++ goto ret; ++ } ++ + my_socket = socket (curr_res->ai_family, curr_res->ai_socktype, curr_res->ai_protocol); + + if (my_socket < 0) +@@ -161,8 +217,358 @@ sftpfs_open_socket (struct vfs_s_super *super, GError ** mcerror) + } + + /* --------------------------------------------------------------------------------------------- */ ++ ++/** ++ * Read ~/.ssh/known_hosts file. ++ * ++ * @param super connection data ++ * @param mcerror pointer to the error handler ++ * @return TRUE on success, FALSE otherwise ++ * ++ * Thanks the Curl project for the code used in this function. ++ */ ++static gboolean ++sftpfs_read_known_hosts (struct vfs_s_super *super, GError ** mcerror) ++{ ++ sftpfs_super_t *sftpfs_super = SFTP_SUPER (super); ++ struct libssh2_knownhost *store = NULL; ++ int rc; ++ gboolean found = FALSE; ++ ++ sftpfs_super->known_hosts = libssh2_knownhost_init (sftpfs_super->session); ++ if (sftpfs_super->known_hosts == NULL) ++ goto err; ++ ++ sftpfs_super->known_hosts_file = ++ mc_build_filename (mc_config_get_home_dir (), ".ssh", "known_hosts", (char *) NULL); ++ rc = libssh2_knownhost_readfile (sftpfs_super->known_hosts, sftpfs_super->known_hosts_file, ++ LIBSSH2_KNOWNHOST_FILE_OPENSSH); ++ if (rc > 0) ++ { ++ const char *kh_name_end = NULL; ++ ++ while (!found && libssh2_knownhost_get (sftpfs_super->known_hosts, &store, store) == 0) ++ { ++ /* For non-standard ports, the name will be enclosed in ++ * square brackets, followed by a colon and the port */ ++ if (store == NULL) ++ continue; ++ ++ if (store->name == NULL) ++ found = TRUE; ++ else if (store->name[0] != '[') ++ found = strcmp (store->name, super->path_element->host) == 0; ++ else ++ { ++ int port; ++ ++ kh_name_end = strstr (store->name, "]:"); ++ if (kh_name_end == NULL) ++ /* Invalid host pattern */ ++ continue; ++ ++ port = (int) g_ascii_strtoll (kh_name_end + 2, NULL, 10); ++ if (port == super->path_element->port) ++ { ++ size_t kh_name_size; ++ ++ kh_name_size = strlen (store->name) - 1 - strlen (kh_name_end); ++ found = strncmp (store->name + 1, super->path_element->host, kh_name_size) == 0; ++ } ++ } ++ } ++ } ++ ++ if (found) ++ { ++ int mask; ++ const char *hostkey_method = NULL; ++ ++ mask = store->typemask & LIBSSH2_KNOWNHOST_KEY_MASK; ++ ++ switch (mask) ++ { ++#ifdef LIBSSH2_KNOWNHOST_KEY_ED25519 ++ case LIBSSH2_KNOWNHOST_KEY_ED25519: ++ hostkey_method = hostkey_method_ssh_ed25519; ++ break; ++#endif ++#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_521 ++ case LIBSSH2_KNOWNHOST_KEY_ECDSA_521: ++ hostkey_method = hostkey_method_ssh_ecdsa_521; ++ break; ++#endif ++#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_384 ++ case LIBSSH2_KNOWNHOST_KEY_ECDSA_384: ++ hostkey_method = hostkey_method_ssh_ecdsa_384; ++ break; ++#endif ++#ifdef LIBSSH2_KNOWNHOST_KEY_ECDSA_256 ++ case LIBSSH2_KNOWNHOST_KEY_ECDSA_256: ++ hostkey_method = hostkey_method_ssh_ecdsa_256; ++ break; ++#endif ++ case LIBSSH2_KNOWNHOST_KEY_SSHRSA: ++ hostkey_method = hostkey_method_ssh_rsa; ++ break; ++ case LIBSSH2_KNOWNHOST_KEY_SSHDSS: ++ hostkey_method = hostkey_method_ssh_dss; ++ break; ++ case LIBSSH2_KNOWNHOST_KEY_RSA1: ++ mc_propagate_error (mcerror, 0, "%s", ++ _("sftp: found host key of unsupported type: RSA1")); ++ return FALSE; ++ default: ++ mc_propagate_error (mcerror, 0, "%s %d", _("sftp: unknown host key type:"), mask); ++ return FALSE; ++ } ++ ++ rc = libssh2_session_method_pref (sftpfs_super->session, LIBSSH2_METHOD_HOSTKEY, ++ hostkey_method); ++ if (rc < 0) ++ goto err; ++ } ++ ++ return TRUE; ++ ++ err: ++ { ++ int sftp_errno; ++ ++ sftp_errno = libssh2_session_last_errno (sftpfs_super->session); ++ sftpfs_ssherror_to_gliberror (sftpfs_super, sftp_errno, mcerror); ++ } ++ return FALSE; ++} ++ ++/* --------------------------------------------------------------------------------------------- */ ++ ++/** ++ * Write new host + key pair to the ~/.ssh/known_hosts file. ++ * ++ * @param super connection data ++ * @param remote_key he key for the remote host ++ * @param remote_key_len length of @remote_key ++ * @param type_mask info about format of host name, key and key type ++ * @return 0 on success, regular libssh2 error code otherwise ++ * ++ * Thanks the Curl project for the code used in this function. ++ */ ++static int ++sftpfs_update_known_hosts (struct vfs_s_super *super, const char *remote_key, size_t remote_key_len, ++ int type_mask) ++{ ++ sftpfs_super_t *sftpfs_super = SFTP_SUPER (super); ++ int rc; ++ ++ /* add this host + key pair */ ++ rc = libssh2_knownhost_addc (sftpfs_super->known_hosts, super->path_element->host, NULL, ++ remote_key, remote_key_len, NULL, 0, type_mask, NULL); ++ if (rc < 0) ++ return rc; ++ ++ /* write the entire in-memory list of known hosts to the known_hosts file */ ++ rc = libssh2_knownhost_writefile (sftpfs_super->known_hosts, sftpfs_super->known_hosts_file, ++ LIBSSH2_KNOWNHOST_FILE_OPENSSH); ++ ++ if (rc < 0) ++ return rc; ++ ++ (void) message (D_NORMAL, _("Information"), ++ _("Permanently added\n%s (%s)\nto the list of known hosts."), ++ super->path_element->host, sftpfs_super->ip_address); ++ ++ return 0; ++} ++ ++/* --------------------------------------------------------------------------------------------- */ ++/** ++ * Compute and return readable host key fingerprint hash. ++ * ++ * @param session libssh2 session handle ++ * @return pointer to static buffer on success, NULL otherwise ++ */ ++static const char * ++sftpfs_compute_fingerprint_hash (LIBSSH2_SESSION * session) ++{ ++ static char result[SHA1_DIGEST_LENGTH * 3 + 1]; /* "XX:" for each byte, and EOL */ ++ const char *fingerprint; ++ size_t i; ++ ++ /* The fingerprint points to static storage (!), don't free() it. */ ++ fingerprint = libssh2_hostkey_hash (session, LIBSSH2_HOSTKEY_HASH_SHA1); ++ if (fingerprint == NULL) ++ return NULL; ++ ++ for (i = 0; i < SHA1_DIGEST_LENGTH && i * 3 < sizeof (result) - 1; i++) ++ g_snprintf ((gchar *) (result + i * 3), 4, "%02x:", (guint8) fingerprint[i]); ++ ++ /* remove last ":" */ ++ result[i * 3 - 1] = '\0'; ++ ++ return result; ++} ++ ++/* --------------------------------------------------------------------------------------------- */ ++ + /** +- * Recognize authenticaion types supported by remote side and filling internal 'super' structure by ++ * Process host info found in ~/.ssh/known_hosts file. ++ * ++ * @param super connection data ++ * @param mcerror pointer to the error handler ++ * @return TRUE on success, FALSE otherwise ++ * ++ * Thanks the Curl project for the code used in this function. ++ */ ++static gboolean ++sftpfs_process_known_host (struct vfs_s_super *super, GError ** mcerror) ++{ ++ sftpfs_super_t *sftpfs_super = SFTP_SUPER (super); ++ const char *remote_key; ++ const char *key_type; ++ const char *fingerprint_hash; ++ size_t remote_key_len = 0; ++ int remote_key_type = LIBSSH2_HOSTKEY_TYPE_UNKNOWN; ++ int keybit = 0; ++ struct libssh2_knownhost *host = NULL; ++ int rc; ++ char *msg = NULL; ++ gboolean handle_query = FALSE; ++ ++ remote_key = libssh2_session_hostkey (sftpfs_super->session, &remote_key_len, &remote_key_type); ++ if (remote_key == NULL || remote_key_len == 0 ++ || remote_key_type == LIBSSH2_HOSTKEY_TYPE_UNKNOWN) ++ { ++ mc_propagate_error (mcerror, 0, "%s", _("sftp: cannot get the remote host key")); ++ return FALSE; ++ } ++ ++ switch (remote_key_type) ++ { ++ case LIBSSH2_HOSTKEY_TYPE_RSA: ++ keybit = LIBSSH2_KNOWNHOST_KEY_SSHRSA; ++ key_type = "RSA"; ++ break; ++ case LIBSSH2_HOSTKEY_TYPE_DSS: ++ keybit = LIBSSH2_KNOWNHOST_KEY_SSHDSS; ++ key_type = "DSS"; ++ break; ++#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_256 ++ case LIBSSH2_HOSTKEY_TYPE_ECDSA_256: ++ keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_256; ++ key_type = "ECDSA"; ++ break; ++#endif ++#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_384 ++ case LIBSSH2_HOSTKEY_TYPE_ECDSA_384: ++ keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_384; ++ key_type = "ECDSA"; ++ break; ++#endif ++#ifdef LIBSSH2_HOSTKEY_TYPE_ECDSA_521 ++ case LIBSSH2_HOSTKEY_TYPE_ECDSA_521: ++ keybit = LIBSSH2_KNOWNHOST_KEY_ECDSA_521; ++ key_type = "ECDSA"; ++ break; ++#endif ++#ifdef LIBSSH2_HOSTKEY_TYPE_ED25519 ++ case LIBSSH2_HOSTKEY_TYPE_ED25519: ++ keybit = LIBSSH2_KNOWNHOST_KEY_ED25519; ++ key_type = "ED25519"; ++ break; ++#endif ++ default: ++ mc_propagate_error (mcerror, 0, "%s", ++ _("sftp: unsupported key type, can't check remote host key")); ++ return FALSE; ++ } ++ ++ fingerprint_hash = sftpfs_compute_fingerprint_hash (sftpfs_super->session); ++ if (fingerprint_hash == NULL) ++ { ++ mc_propagate_error (mcerror, 0, "%s", _("sftp: can't compute host key fingerprint hash")); ++ return FALSE; ++ } ++ ++ rc = libssh2_knownhost_checkp (sftpfs_super->known_hosts, super->path_element->host, ++ super->path_element->port, remote_key, remote_key_len, ++ LIBSSH2_KNOWNHOST_TYPE_PLAIN | LIBSSH2_KNOWNHOST_KEYENC_RAW | ++ keybit, &host); ++ ++ switch (rc) ++ { ++ default: ++ case LIBSSH2_KNOWNHOST_CHECK_FAILURE: ++ /* something prevented the check to be made */ ++ goto err; ++ ++ case LIBSSH2_KNOWNHOST_CHECK_MATCH: ++ /* host + key pair matched -- OK */ ++ break; ++ ++ case LIBSSH2_KNOWNHOST_CHECK_NOTFOUND: ++ /* no host match was found -- add it to the known_hosts file */ ++ msg = g_strdup_printf (_("The authenticity of host\n%s (%s)\ncan't be established!\n" ++ "%s key fingerprint hash is\nSHA1:%s.\n" ++ "Do you want to add it to the list of known hosts and continue connecting?"), ++ super->path_element->host, sftpfs_super->ip_address, ++ key_type, fingerprint_hash); ++ /* Select "No" initially */ ++ query_set_sel (2); ++ rc = query_dialog (_("Warning"), msg, D_NORMAL, 3, _("&Yes"), _("&Ignore"), _("&No")); ++ g_free (msg); ++ handle_query = TRUE; ++ break; ++ ++ case LIBSSH2_KNOWNHOST_CHECK_MISMATCH: ++ msg = g_strdup_printf (_("%s (%s)\nis found in the list of known hosts but\n" ++ "KEYS DO NOT MATCH! THIS COULD BE A MITM ATTACK!\n" ++ "Are you sure you want to add it to the list of known hosts and continue connecting?"), ++ super->path_element->host, sftpfs_super->ip_address); ++ /* Select "No" initially */ ++ query_set_sel (2); ++ rc = query_dialog (MSG_ERROR, msg, D_ERROR, 3, _("&Yes"), _("&Ignore"), _("&No")); ++ g_free (msg); ++ handle_query = TRUE; ++ break; ++ } ++ ++ if (handle_query) ++ switch (rc) ++ { ++ case 0: ++ /* Yes: add this host + key pair, continue connecting */ ++ if (sftpfs_update_known_hosts (super, remote_key, remote_key_len, ++ LIBSSH2_KNOWNHOST_TYPE_PLAIN ++ | LIBSSH2_KNOWNHOST_KEYENC_RAW | keybit) < 0) ++ goto err; ++ break; ++ case 1: ++ /* Ignore: do not add this host + key pair, continue connecting anyway */ ++ break; ++ case 2: ++ default: ++ mc_propagate_error (mcerror, 0, "%s", _("sftp: host key verification failed")); ++ /* No: abort connection */ ++ goto err; ++ } ++ ++ return TRUE; ++ ++ err: ++ { ++ int sftp_errno; ++ ++ sftp_errno = libssh2_session_last_errno (sftpfs_super->session); ++ sftpfs_ssherror_to_gliberror (sftpfs_super, sftp_errno, mcerror); ++ } ++ ++ return FALSE; ++} ++ ++/* --------------------------------------------------------------------------------------------- */ ++/** ++ * Recognize authentication types supported by remote side and filling internal 'super' structure by + * proper enum's values. + * + * @param super connection data +@@ -461,6 +867,9 @@ sftpfs_open_connection (struct vfs_s_super *super, GError ** mcerror) + if (sftpfs_super->session == NULL) + return (-1); + ++ if (!sftpfs_read_known_hosts (super, mcerror)) ++ return (-1); ++ + /* ... start it up. This will trade welcome banners, exchange keys, + * and setup crypto, compression, and MAC layers + */ +@@ -475,13 +884,8 @@ sftpfs_open_connection (struct vfs_s_super *super, GError ** mcerror) + return (-1); + } + +- /* At this point we havn't yet authenticated. The first thing to do +- * is check the hostkey's fingerprint against our known hosts Your app +- * may have it hard coded, may go to a file, may present it to the +- * user, that's your call +- */ +- sftpfs_super->fingerprint = +- libssh2_hostkey_hash (sftpfs_super->session, LIBSSH2_HOSTKEY_HASH_SHA1); ++ if (!sftpfs_process_known_host (super, mcerror)) ++ return (-1); + + if (!sftpfs_recognize_auth_types (super)) + { +@@ -538,7 +942,13 @@ sftpfs_close_connection (struct vfs_s_super *super, const char *shutdown_message + sftpfs_super->agent = NULL; + } + +- sftpfs_super->fingerprint = NULL; ++ if (sftpfs_super->known_hosts != NULL) ++ { ++ libssh2_knownhost_free (sftpfs_super->known_hosts); ++ sftpfs_super->known_hosts = NULL; ++ } ++ ++ MC_PTR_FREE (sftpfs_super->known_hosts_file); + + if (sftpfs_super->session != NULL) + { +diff --git a/src/vfs/sftpfs/internal.h b/src/vfs/sftpfs/internal.h +index 5616fb8990..643ce5e3cc 100644 +--- a/src/vfs/sftpfs/internal.h ++++ b/src/vfs/sftpfs/internal.h +@@ -42,6 +42,9 @@ typedef struct + sftpfs_auth_type_t auth_type; + sftpfs_auth_type_t config_auth_type; + ++ LIBSSH2_KNOWNHOSTS *known_hosts; ++ char *known_hosts_file; ++ + LIBSSH2_SESSION *session; + LIBSSH2_SFTP *sftp_session; + +@@ -51,7 +54,7 @@ typedef struct + char *privkey; + + int socket_handle; +- const char *fingerprint; ++ const char *ip_address; + vfs_path_element_t *original_connection_info; + } sftpfs_super_t; + diff --git a/meta/recipes-extended/mc/mc_4.8.26.bb b/meta/recipes-extended/mc/mc_4.8.26.bb index 5c5e6790d8..6bc7e6e8e1 100644 --- a/meta/recipes-extended/mc/mc_4.8.26.bb +++ b/meta/recipes-extended/mc/mc_4.8.26.bb @@ -11,6 +11,7 @@ RRECOMMENDS_${PN} = "ncurses-terminfo" SRC_URI = "http://www.midnight-commander.org/downloads/${BPN}-${PV}.tar.bz2 \ file://0001-mc-replace-perl-w-with-use-warnings.patch \ file://nomandate.patch \ + file://CVE-2021-36370.patch \ " SRC_URI[sha256sum] = "9d6358d0a351a455a1410aab57f33b6b48b0fcf31344b9a10b0ff497595979d1" -- 2.17.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#155898): https://lists.openembedded.org/g/openembedded-core/message/155898 Mute This Topic: https://lists.openembedded.org/mt/85504693/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
