[ssh_x509] Release to match OpenSSH 9.3p2?

[ssh_x509 at roumenpetrov.info]

Hello,

ssh_x509 at roumenpetrov.info wrote:
> Hi Roumen,
> I noticed this week that OpenSSH has released version 9.3p2 to address a CVE. Will there be a release of PKIX-SSH to address this as well?
Currently there is no plan for new release

> I see you have made a commit adapting part of their fix.
Only part that exits with fatal on attempts to load library that does not provide PKCS11 functions was added.

The other part is based on host-bound functionality never supported by PKIX-SSH. The reason - a host-bound agent restriction adds a lot of new code in insecure agent functionality.

Forward of agent is disabled by default. So impact is on system with forward agent.
But recommended functionality is proxy jump instead.

Next remote load was possible due to hard-coded pattern that allows any library to be loaded. Work-around is simple start agent with exact library list.
So I wonder why do not drop hard-coded pattern.


Also note that PKIX-SSH allows use of keys from "engine" and "store". So why to use key wallet based on ssh-agent?

May be is time to mark agent functionality as deprecated.


> If we pull in that change, would that address the vulnerability in PKIX-SSH or will more be coming?
>
>
> Thank you,
> Alex


Roumen