Package: x2goclient
Version: 4.1.1.1

SSH key fails to be copied to the remote side because the path use a tilde, so 
neither file sharing nor client-side printing works.

Client OS Ubuntu 18.04.3 LTS with libssh-4 0.8.0~20170825.94fa1e38-1ubuntu0.5
Server OS Ubuntu 16.04.6 LTS

Since december, 10th on Ubuntu, every time I connect to a server with either 
file sharing or printing enabled I have this error message :
"Cannot create remote file ~ilm/.x2go/ssh/key.jdT502" - "SCP: Warning: status code 1 
received: scp: ~ilm/.x2go/ssh: No such file or directory\n"
But the directory does exist.

After using gdb I saw that ONMainWindow::exportDirs() calls SshMasterConnection::copyFile() with 
dst="~"+uname +"/.x2go/ssh/"+dst;
which is ultimately passed to libssh. But following CVE-2019-14889 the path is 
now literal (quoted), see
https://git.libssh.org/projects/libssh.git/log/src/scp.c for the libssh logs and
https://usn.ubuntu.com/4219-1/ for the ubuntu packages

A similar issue is handled for Windows in SshProcess::start_cp()

As a workaround I reinstalled an old version of the libssh-4 package and the 
bug went away.
_______________________________________________
x2go-dev mailing list
x2go-dev@lists.x2go.org
https://lists.x2go.org/listinfo/x2go-dev

Reply via email to