bugzilla-daemon at bugzilla.mindrot.org
2016-Jan-05 19:15 UTC
[Bug 2520] New: ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Bug ID: 2520 Summary: ssh-keygen: sanitize ANSI escape sequences in key comment Product: Portable OpenSSH Version: 7.1p1 Hardware: amd64 OS: Linux Status: NEW Severity: minor Priority: P5 Component: ssh-keygen Assignee: unassigned-bugs at mindrot.org Reporter: rohieb+bugzillamindrotorg at rohieb.name Created attachment 2775 --> https://bugzilla.mindrot.org/attachment.cgi?id=2775&action=edit public key with ANSI escape sequences I noticed that ssh-keygen prints most non-printable characters in the comment as-is when showing the fingerprint of a key. This can lead to confusing output on the terminal when the comment contains ANSI escape characters which are interpreted by the terminal. The attached public key file serves as an example, which, when fingerprinted on my Linux terminal, looks like this: $ ssh-keygen -E sha256 -lf test.pub 1024 MD5:de:ad:be:ef:00:7h:15:15:af:0r:6e:d0:ha:5h:00:00 nobody at example.org (RSA) ... in nice rainbow colors (see attached screenshot). Also note that a SHA256 hash was requested whereas the output is an MD5 hash (which also contains invalid characters, so it cannot really be an MD5 hash...), but you get the point that, in general, this technique can be used to suppress the real fingerprint of a key and let the user see a different one. For this reason, I suggest applying the attached patch (based on commit 271df81 from the OpenSSH Portable GitHub repository), which emplys strvis() to escape possibly dangerous characters in the comment prior to printing it to the terminal. This should serve as a sufficient workaround for the obfuscating escape behaviour of the underlying terminal emulator. -- You are receiving this mail because: You are watching the assignee of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2016-Jan-05 19:16 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 --- Comment #1 from Roland Hieber <rohieb+bugzillamindrotorg at rohieb.name> --- Created attachment 2776 --> https://bugzilla.mindrot.org/attachment.cgi?id=2776&action=edit screenshot showing the output from ssh-keygen on the public key -- You are receiving this mail because: You are watching the assignee of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2016-Jan-05 19:19 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 --- Comment #2 from Roland Hieber <rohieb+bugzillamindrotorg at rohieb.name> --- Created attachment 2777 --> https://bugzilla.mindrot.org/attachment.cgi?id=2777&action=edit proposed patch -- You are receiving this mail because: You are watching the assignee of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2016-Jan-06 07:11 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |djm at mindrot.org --- Comment #3 from Damien Miller <djm at mindrot.org> --- This is not going to be popular with users who have UTF-8 or other non-ASCII characters in their comments. We need something like that proposed for bug #2058 -- You are receiving this mail because: You are watching someone on the CC list of the bug. You are watching the assignee of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2017-Feb-10 03:00 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #2777|0 |1 is obsolete| | CC| |dtucker at zip.com.au Status|NEW |ASSIGNED Assignee|unassigned-bugs at mindrot.org |djm at mindrot.org Attachment #2940| |ok?(dtucker at zip.com.au) Flags| | --- Comment #4 from Damien Miller <djm at mindrot.org> --- Created attachment 2940 --> https://bugzilla.mindrot.org/attachment.cgi?id=2940&action=edit sanitise escape sequences but not valid UTF-8 when the locale supports it This patch uses Ingo's recent mprintf API to safely render strings while preserving UTF-8 characters when the locale supports them. -- You are receiving this mail because: You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2017-Feb-10 03:00 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2647 Referenced Bugs: https://bugzilla.mindrot.org/show_bug.cgi?id=2647 [Bug 2647] Tracking bug for OpenSSH 7.5 release -- You are receiving this mail because: You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2017-Feb-10 03:04 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Darren Tucker <dtucker at zip.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #2940|ok?(dtucker at zip.com.au) |ok+ Flags| | -- You are receiving this mail because: You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2017-Feb-10 03:38 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|ASSIGNED |RESOLVED --- Comment #5 from Damien Miller <djm at mindrot.org> --- Fix applied. This will be in OpenSSH 7.5 commit a287c5ad1e0bf9811c7b9221979b969255076019 Author: djm at openbsd.org <djm at openbsd.org> Date: Fri Feb 10 03:36:40 2017 +0000 upstream commit Sanitise escape sequences in key comments sent to printf but preserve valid UTF-8 when the locale supports it; bz#2520 ok dtucker@ Upstream-ID: e8eed28712ba7b22d49be534237eed019875bd1e -- You are receiving this mail because: You are watching someone on the CC list of the bug. You are watching the assignee of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2018-Apr-06 02:26 UTC
[Bug 2520] ssh-keygen: sanitize ANSI escape sequences in key comment
https://bugzilla.mindrot.org/show_bug.cgi?id=2520 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #6 from Damien Miller <djm at mindrot.org> --- Close all resolved bugs after release of OpenSSH 7.7. -- You are receiving this mail because: You are watching someone on the CC list of the bug. You are watching the assignee of the bug.