[openssh-commits] [openssh] 01/01: upstream: include SHA2-variant RSA key algorithms in KEX proposal;

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 7250879c72d28275a53f2f220e49646c3e42ef18
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Fri Jul 12 04:08:39 2019 +0000

    upstream: include SHA2-variant RSA key algorithms in KEX proposal;
    
    allows ssh-keyscan to harvest keys from servers that disable olde SHA1
    ssh-rsa. bz#3029 from Jakub Jelen
    
    OpenBSD-Commit-ID: 9f95ebf76a150c2f727ca4780fb2599d50bbab7a
---
 ssh-keyscan.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index d95ba1b3..d383b57b 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.128 2019/06/28 13:35:04 deraadt Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.129 2019/07/12 04:08:39 djm Exp $ */
 /*
  * Copyright 1995, 1996 by David Mazieres <dm at lcs.mit.edu>.
  *
@@ -233,7 +233,12 @@ keygrab_ssh2(con *c)
 		break;
 	case KT_RSA:
 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
-		    "ssh-rsa-cert-v01 at openssh.com" : "ssh-rsa";
+		    "rsa-sha2-512-cert-v01 at openssh.com,"
+		    "rsa-sha2-256-cert-v01 at openssh.com,"
+		    "ssh-rsa-cert-v01 at openssh.com" :
+		    "rsa-sha2-512,"
+		    "rsa-sha2-256,"
+		    "ssh-rsa";
 		break;
 	case KT_ED25519:
 		myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.