[ssh_x509] Release to match OpenSSH 9.3p2?

[ssh_x509 at roumenpetrov.info]

Hello,

ssh_x509 at roumenpetrov.info wrote:
> Hello,
>
> ssh_x509 at roumenpetrov.info wrote:
>> Hi Roumen,
>> I noticed this week that OpenSSH has released version 9.3p2 to address a CVE. Will there be a release of PKIX-SSH to address this as well?
> Currently there is no plan for new release .
[SNIP]

It seems to me patch that terminates "helper" on attempt to load non-pkcs11 module has side effects - agent cannot use more pkcs11. So, release 9.3p2 does not look usable.
Remark: load non-pkcs11 module could due to user mistake.


There is another functionality - load "helper" per module. It is expected this to be part of release but is not.
Perhaps I will revert patch until is adapted separate load.

Most effective is to restrict "pattern" to real modules. It  seems to me remove of default pattern is good solution without to add lots of code.


Regards,
Roumen


Remark: Note that exploit requires presence of "special" libraries on host that run agent, agent forwarding enabled , pattern that allows load of such libraries (specific), and connection to remote system controlled by attacker.