From 87db2659ec608a977a63eea529f17b9168388d73 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Tue, 5 Aug 2025 18:42:31 +0200 Subject: [PATCH] CVE-2025-8277: packet: Adjust packet filter to work when DH-GEX is guessed wrongly Signed-off-by: Jakub Jelen Reviewed-by: Andreas Schneider (cherry picked from commit 4310a696f2d632c6742678077d703d9b9ff3bc0e) --- src/packet.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/packet.c b/src/packet.c index f15aa2ad..f54b3158 100644 --- a/src/packet.c +++ b/src/packet.c @@ -294,6 +294,7 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se * or session_state == SSH_SESSION_STATE_INITIAL_KEX * - dh_handshake_state == DH_STATE_INIT * or dh_handshake_state == DH_STATE_INIT_SENT (re-exchange) + * or dh_handshake_state == DH_STATE_REQUEST_SENT (dh-gex) * or dh_handshake_state == DH_STATE_FINISHED (re-exchange) * * Transitions: @@ -313,6 +314,7 @@ static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session se if ((session->dh_handshake_state != DH_STATE_INIT) && (session->dh_handshake_state != DH_STATE_INIT_SENT) && + (session->dh_handshake_state != DH_STATE_REQUEST_SENT) && (session->dh_handshake_state != DH_STATE_FINISHED)) { rc = SSH_PACKET_DENIED;