Hi, On Fr 20 Dez 2019 20:32:49 CET, Mihai Moldovan wrote:
tag #1428 pending fixed #1428 4.1.2.2 thanks
Hello,
X2Go issue #1428 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at:
http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=ce559d1The issue will most likely be fixed in src:x2goclient (4.1.2.2).
light+love X2Go Git Admin (on behalf of the sender of this mail)
commit ce559d163a943737fe4160f7233925df2eee1f9a Author: Mihai Moldovan <ionic@ionic.de> Date: Fri Dec 20 20:27:31 2019 +0100
src/sshprocess.cpp: strip ~/, ~user{,/}, ${HOME}{,/} and$HOME{,/} from destination paths in scp mode. Fixes: #1428.
This was already necessary for pascp (PuTTY-based Windows solution for Kerberos support), but newer libssh versions with the CVE-2019-14889 also interpret paths as literal strings.diff --git a/debian/changelog b/debian/changelog index 504d6ae..9f84281 100644 --- a/debian/changelog +++ b/debian/changelog @@ -135,6 +135,11 @@ x2goclient (4.1.2.2-0x2go1) UNRELEASED; urgency=medium sound weird first, but this behavior is consistent between all applications - tray icons can be clicked via either button and will always trigger a context menu. Let X2Go Client behave the same way.
- src/sshprocess.cpp: strip ~/, ~user{,/}, ${HOME}{,/} and $HOME{,/} from
destination paths in scp mode. Fixes: #1428. This was alreadyfor pascp (PuTTY-based Windows solution for Kerberoslibssh versions with the CVE-2019-14889 also interpret pathsstrings.
- Add build-depend on pkg-config.
- x2goclient.spec:
Please note that I am currently working on getting this libssh/CVE-2019-14889 robustness patch into Debian [done] and Ubuntu [pending]. Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde mobile: +49 (1520) 1976 148 landline: +49 (4351) 850 8940 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de