octoleo/phpseclib
1
0
Fork 0
mirror of https://github.com/phpseclib/phpseclib.git synced 2024-12-28 12:10:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

SSH2: one more tweak to RSA signature verificatio

Browse Source
This commit is contained in:
terrafrost 2022-01-27 18:26:08 -06:00
parent decbde4f5d
commit a748bf5bef
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
phpseclib/Net/SSH2.php
View File

@ -4971,7 +4971,7 @@ class SSH2
// could be ssh-rsa, rsa-sha2-256, rsa-sha2-512
// we don't check here because we already checked in key_exchange
// some signatures have the type embedded within the message and some don't
Strings::unpackSSH2('s', $signature);
list(, $signature) = Strings::unpackSSH2('ss', $signature);
$key = RSA::loadFormat('OpenSSH', $server_public_host_key)
->withPadding(RSA::SIGNATURE_PKCS1);
@ -4994,6 +4994,7 @@ class SSH2
}
if (!$key->verify($this->exchange_hash, $signature)) {
exit('error');
return $this->disconnect_helper(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE);
};