[ssh_x509] avoid pkcs#11 module misuse

[ssh_x509 at roumenpetrov.info]

Hello,

Using secure shell functionality to load PKCS#11 module is vulnerable to remote code execution.
Prerequisites are enabled agent forwarding, access to host controlled by attacker and specific libraries on site.
Note that insecurity of agent forwarding is documented in manual pages.

Issue with loading of un-trusted modules is not new. List with allowed modules try to address CVE-2016-10009 but is not sufficient. Result is yet another issue CVE-2023-38408.

Following commit "do not allow pkcs11 providers by default" / https://gitlab.com/secsh/pkixssh/-/commit/546d904387d8b3e3006c002b50df16dc1ab6c3da should fix CVE-2016-10009 finally. As side effect it should prevent scenario that leads to CVE-2023-38408.

Remark: Pattern could be redefined at build time or at run time by agent options -P.


Regards,
Roumen Petrov