Seven new net-ssh advisories

gems/net-ssh/GHSA-3x7f-q7wf-fp73.yml

@@ -0,0 +1,57 @@
+---
+gem: net-ssh
+ghsa: 3x7f-q7wf-fp73
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-3x7f-q7wf-fp73
+title: Shell injection via unescaped substitution in ProxyCommand
+  and ProxyJump command templates in net-ssh
+date: 2026-10-05
+description: |
+  ## Summary
+
+  Shell command injection is possible in Net::SSH::Proxy::Command and
+  Net::SSH::Proxy::Jump. When an application configures a proxy and
+  passes an attacker-influenced host, port, or remote_user to
+  Net::SSH.start (or jump string to Proxy::Jump.new), shell metacharacters
+  in those values are interpreted by /bin/sh, allowing arbitrary
+  command execution on the SSH client machine with the same privileges
+  as the Ruby process.
+
+  This is similar to OpenSSH's CVE-2023-51385 (ProxyCommand/%h/%n command
+  injection), which OpenSSH 9.6 fixed by rejecting hostnames/usernames
+  containing shell metacharacters.
+
+  net-ssh does no similar validation or escaping on these values.
+
+  ## Impact
+
+  This is hopefully not a common use-case / configuration that would be
+  abusable in production applications, but it seems worth fixing regardless.
+
+  This exploit allows arbitrary command execution on the client running
+  net-ssh. Requires that the application (1) configures a Proxy::Command
+  or Proxy::Jump and (2) passes attacker-influenced host/port/remote_user
+  (or jump string) without the client's own additional sanitization.
+  net-ssh is a transitive dependency of Capistrano, Chef, Vagrant, etc,
+  which seem the most likely to be exposed to a vulnerability like this.
+
+  ## net-sftp Too:
+
+  net-sftp is also affected: Net::SFTP.start(host, user, ssh_options)
+  forwards host and ssh_options (including :proxy) verbatim to
+  Net::SSH.start, so the same injection is reachable through the
+  net-sftp API as a result of this vulnerability (though no patch
+  is needed in net-sftp itself).
+patched_versions:
+  - "~> 7.3.5, >= 7.4.0"
+  - ">= 8.0.0.rc2"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
+    - https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
+    - https://rubygems.org/gems/net-ssh/versions/7.3.5
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-3x7f-q7wf-fp73
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - GHSA URL has "moderate" severity but no number.

gems/net-ssh/GHSA-ggxh-cfwq-5xqc.yml

@@ -0,0 +1,33 @@
+---
+gem: net-ssh
+ghsa: ggxh-cfwq-5xqc
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-ggxh-cfwq-5xqc
+title: Pre-auth unbounded KEX packet queue leads to memory exhaustion
+date: 2026-10-05
+description: |
+  ## Summary
+
+  Net::SSH::Transport::Session#poll_message pushes every packet received
+  during key exchange that is not on the "allowed during KEX" list into
+  an unbounded @queue (Array), with no size cap. A malicious server
+  that completes KEXINIT (putting net-ssh into pending KEX) and then
+  floods non-allowed packet types causes the client to queue all of
+  them — a pre-authentication memory-exhaustion DoS.
+
+  ## Credit
+
+  Reported by zhangph (afldl), 2026-07.
+patched_versions:
+  - "~> 7.3.5, >= 7.4.0"
+  - ">= 8.0.0.rc2"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
+    - https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
+    - https://rubygems.org/gems/net-ssh/versions/7.3.5
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-ggxh-cfwq-5xqc
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - GHSA URL has "moderate" severity but no number.

gems/net-ssh/GHSA-pfqh-p9vh-wx4p.yml

@@ -0,0 +1,32 @@
+---
+gem: net-ssh
+ghsa: pfqh-p9vh-wx4p
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-pfqh-p9vh-wx4p
+title: Pre-auth unbounded transport packet_size leads to memory exhaustion
+date: 2026-10-05
+description: |
+  ## Summary
+
+  net-ssh's transport packet reader trusts the 4-byte wire packet length
+  without capping it against RFC 4253 §6.1 (35000 bytes). Pre-KEX
+  (plaintext), a malicious server can declare an arbitrarily large
+  packet length and stream data, causing unbounded client memory
+  growth before authentication.
+
+  ## Credit
+
+  Reported by zhangph (afldl), 2026-07.
+patched_versions:
+  - "~> 7.3.5, >= 7.4.0"
+  - ">= 8.0.0.rc2"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
+    - https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
+    - https://rubygems.org/gems/net-ssh/versions/7.3.5
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-pfqh-p9vh-wx4p
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - GHSA URL has "moderate" severity but no number.

gems/net-ssh/GHSA-qpg5-fx6p-8cq3.yml

@@ -0,0 +1,86 @@
+---
+gem: net-ssh
+ghsa: qpg5-fx6p-8cq3
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-qpg5-fx6p-8cq3
+title: Using port forwarding silently enables server access to
+  the local SSH agent | pkg:gem/net-ssh@8.0.0.beta3
+date: 2026-10-05
+description: |
+
+  Improper authorization in net-ssh: Service::Forward#initialize
+  registers server-initiated auth-agent channel handlers unconditionally,
+  so ordinary port forwarding exposes the local SSH agent
+
+  ## Summary
+
+  Net::SSH::Service::Forward#initialize registers channel handlers for
+  the server-initiated channel types auth-agent and auth-agent@openssh.com
+  at the moment the forwarding service is instantiated, alongside the
+  expected forwarded-tcpip handler. Nothing in that registration, and
+  nothing in auth_agent_channel itself, consults options[:forward_agent]
+  or the service's own @agent_forwarded flag. A consumer that uses
+  ordinary TCP or UNIX-socket forwarding with the default forward_agent:
+  false therefore still accepts an auth-agent@openssh.com channel opened
+  by the remote server, connects to the local SSH agent, and relays raw
+  agent protocol to that server.
+
+  In a realistic consuming application, the attacker is the SSH server
+  (malicious or compromised): it controls the channel_type of the
+  CHANNEL_OPEN packets it sends, and Connection::Session#channel_open
+  dispatches any channel type that has a registered handler. No prior
+  auth-agent-req from the client is required, and no client code ever
+  asked for agent forwarding.
+
+  Related paths, for contrast:
+
+  * Client-side opt-in guard in Channel#do_open_confirmation — checks
+    connection.options[:forward_agent] before the client sends an enable
+    request (lib/net/ssh/channel.rb:534).
+
+  * The vulnerable path: incoming auth-agent / auth-agent@openssh.com
+    handlers registered independently of that guard — unguarded,
+    lib/net/ssh/service/forward.rb:25-35.
+
+  * A client that never instantiates the forwarding service — the
+    same server request is refused with CHANNEL_OPEN_FAILURE code 3,
+    "unknown channel type auth-agent@openssh.com" (observed in the
+    verification negative control).
+
+  The documented design intent is that agent forwarding is an explicit
+  opt-in: lib/net/ssh/service/forward.rb:277-289 states that agent
+  forwarding is enabled when the connection was created with
+  :forward_agent => true, while the README documents ssh.forward.local
+  independently. Port forwarding is not documented as authorizing
+  agent forwarding.
+
+  ## Impact
+
+  A malicious or compromised SSH server gains a live relay to the client's
+  local ssh-agent. It can enumerate the victim's loaded identities and
+  request signatures over attacker-chosen data, which lets it authenticate
+  onward to other hosts as the victim — using keys the victim's application
+  never intended to expose to that server. This happens while the
+  application's configuration says agent forwarding is off.
+
+  The delta versus safe behaviour: with forward_agent false and no
+  forwarding service instantiated, a server that opens an auth-agent@openssh.com
+  channel gets CHANNEL_OPEN_FAILURE and never touches the agent. Merely
+  calling ssh.forward.local (or another forwarding API) converts that
+  refusal into a working agent relay. Port forwarding and agent forwarding
+  are separate capabilities in the SSH ecosystem and in this library's
+  own documentation; this collapses the second into the first.
+cvss_v3: 8.0
+patched_versions:
+  - "~> 7.3.5, >= 7.4.0"
+  - ">= 8.0.0.rc2"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
+    - https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
+    - https://rubygems.org/gems/net-ssh/versions/7.3.5
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-qpg5-fx6p-8cq3
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - cvss_v3 from GHSA URL.

gems/net-ssh/GHSA-r75w-7fhp-84w8.yml

@@ -0,0 +1,32 @@
+---
+gem: net-ssh
+ghsa: r75w-7fhp-84w8
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-r75w-7fhp-84w8
+title: Pre-auth unbounded banner/identification buffering DoS
+date: 2026-10-05
+description: |
+  ## Summary
+
+  Net::SSH::Transport::ServerVersion#read! appends each received byte
+  to @version (@version << b) until \n, then copies to @header
+  (@header << @version). No maximum line length or total byte cap is
+  enforced. A malicious server sending a long identification line
+  without LF causes unbounded client memory growth pre-authentication.
+
+  ## Credit
+
+  Reported by zhangph (afldl), 2026-07.
+patched_versions:
+  - "~> 7.3.5, >= 7.4.0"
+  - ">= 8.0.0.rc2"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
+    - https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
+    - https://rubygems.org/gems/net-ssh/versions/7.3.5
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-r75w-7fhp-84w8
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - GHSA URL has "moderate" severity but no number.

gems/net-ssh/GHSA-rpq3-v334-f5pm.yml

@@ -0,0 +1,33 @@
+---
+gem: net-ssh
+ghsa: rpq3-v334-f5pm
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-rpq3-v334-f5pm
+title: Parsing a specifically crafted ed25519 ssh key will lock net/ssh in DOS
+date: 2026-10-05
+description: |
+  ## Summary
+
+  When a crafted ed25519 private key is loaded which contains an insane
+  number of rounds, it will lock net/ssh in an infinite CPU-time consuming
+  loop for a very long time trying to load the key. That the key itself
+  is not a real ssh key does not matter in this regard.
+
+  ## Impact
+
+  The resulting ruby process will hang for several days (estimated at
+  least half a year) and be locked in the C call, needing to manually
+  terminate the corresponding ruby process.
+patched_versions:
+  - "~> 7.3.5, >= 7.4.0"
+  - ">= 8.0.0.rc2"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.rc2
+    - https://github.com/net-ssh/net-ssh/compare/v8.0.0.rc1...v8.0.0.rc2
+    - https://rubygems.org/gems/net-ssh/versions/7.3.5
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.4...v7.3.5
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-rpq3-v334-f5pm
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - GHSA URL has "moderate" severity but no number.

gems/net-ssh/GHSA-vxj5-fg65-x765.yml

@@ -0,0 +1,61 @@
+---
+gem: net-ssh
+ghsa: vxj5-fg65-x765
+url: https://github.com/net-ssh/net-ssh/security/advisories/GHSA-vxj5-fg65-x765
+title: net-ssh - SSH host-certificate authentication bypass — @cert-authority
+  verifier skips valid_principals / validity window / cert type /
+  critical options, so any CA-signed cert impersonates any host
+  trusting that CA (CWE-295)
+date: 2026-10-04
+description: |
+  ## SUMMARY
+
+  net-ssh's host-certificate verifier
+  (Net::SSH::HostKeyEntries::CertAuthority#matches_key?)
+
+  checks exactly two things when a server presents an OpenSSH certificate
+  (*-cert-v01@openssh.com) under a @cert-authority trusted-CA entry:
+  (1) the cert is self-consistently signed (signature_valid?), and
+  (2) its embedded signature_key equals the trusted CA key. It performs none
+  of the checks OpenSSH applies in sshkey_cert_check_authority:
+
+  * valid_principals is never matched against the target host/IP,
+  * the validity window (valid_after / valid_before) is never checked,
+  * the cert type is never verified to be a HOST cert (a :user cert
+    is accepted),
+  * critical_options are never enforced.
+
+  Those fields are parsed by Certificate.read_certblob but never read
+  by the verifier. The practical consequence: anyone who holds any
+  certificate signed by a CA the victim trusts for host H can impersonate
+  H — even if their cert was issued for a different principal, is expired,
+  or is a user certificate. This is an authentication bypass (not a DoS):
+  after matches_key? returns true the exchange-hash signature is verified
+  against the cert's underlying public key, which the attacker possesses
+  (it is their cert), so the attacker is authenticated as H and owns the
+  post-auth channel (capturing any credentials the client sends).
+
+  Reachable by default: *-cert-v01@openssh.com types head
+  DEFAULT_ALGORITHMS[:host_key] and @cert-authority host-certificate
+  trust is a documented, supported feature.
+
+  ## Credit
+
+  Reported by zhangph (GitHub afldl), 2026-08.
+cvss_v3: 8.1
+unaffected_versions:
+  - "< 6.3.0"
+patched_versions:
+  - "~> 7.3.4, >= 7.4.0"
+  - ">= 8.0.0.beta3"
+related:
+  url:
+    - https://rubygems.org/gems/net-ssh/versions/8.0.0.beta3
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.3...v8.0.0.beta3
+    - https://rubygems.org/gems/net-ssh/versions/7.3.4
+    - https://github.com/net-ssh/net-ssh/compare/v7.3.3...v7.3.4
+    - https://github.com/net-ssh/net-ssh/security/advisories/GHSA-vxj5-fg65-x765
+notes: |
+  - date from rubygems.org URL.
+  - No CVE in GHSA URL.
+  - cvss_v3 from GHSA URL.