Sorry for the confusion - it's not an existing patch in debian/patches,
it's directly in the upstream source code in auth-options.c (around line
828, in sshauthopt_serialise()):
/* String options; these may be NULL */
if ((r = serialise_nullable_string(m,
untrusted ? "yes" : opts->cert_principals)) != 0 ||
(r = serialise_nullable_string(m,
untrusted ? "true" : opts->force_command)) != 0 ||
When untrusted=1, it unconditionally serializes literal "true" without
checking if opts->force_command is NULL.
The patch I attached (openssh-forced-command-null-check.patch) is a
proposed new fix against auth-options.c.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2166842
Title:
sshd: fatal "monitor_child_preauth: unexpected authentication from
102" breaks root public-key login with PermitRootLogin=forced-
commands-only + UsePAM=yes (regression in 1:9.6p1-3ubuntu13.18)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2166842/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
