4 ms·
There are C libraries for SSH, like libssh, that would avoid these type of vulnerabilities. https://www.libssh.org/ https://www.libssh.org/
by deckar01 9y ago
There are C libraries for SSH, like libssh, that would avoid these type of vulnerabilities.
https://www.libssh.org/ https://www.libssh.org/
- peff 9y agoOne downside of libraries like libssh is that they don't behave the same way as your regular ssh command. So thing you've configured like host aliases, proxy commands, etc, don't just work out of the box (and in some cases may not even be supported at all).
- deckar01 9y agoTrue. It sounds like there is room for an ORM-like sanitizer for SSH that is responsible for translating a C API to sanitized commands. I have no clue what to search to find if that already exists.
- virtualized 9y agoIt almost seems like ad-hoc text formats like command line argument syntaxes are difficult to use correctly.
- snakeanus 9y agolibgit2 depends on libssh2 actually.