CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/09/15 18:31:27
Modified files:
usr.bin/ssh : auth2-hostbased.c auth2-pubkey.c kexgen.c
kexgexc.c sshconnect2.c ssherr.c ssherr.h
sshkey.c sshkey.h
Log message:
Check key and CA sig type during key parsing
Checks key type and CA signature algorithm allowlists as early as
possible during public key deserialisation.
Use this in the client and server to reduce attack surface from
disallowed key/signature types.
With Chris Rohlf in collaboration with Claude and Anthropic Research
ok markus, deraadt
