Bug#1103720: ssh-askpass-gnome prompts for confirmation, but the connection is always allowed

Package: ssh-askpass-gnome
Version: 1:9.9p2-2
Severity: grave
Tags: security
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team 
<[email protected]>

Dear Maintainer,

*** Reporter, please consider answering these questions, where 
appropriate ***

* What led up to the situation?

Using:

- ssh-askpass (GNOME version)
- KeePassXC
- GNOME Keyring as the SSH Agent
- setting /run/user/1000/gcr/ssh as SSH_AUTH_SOCK in the KeepassXC settings

Askpass asks to allow using the SSH key. Upon clicking "no", a 
connection is still established.

SSH outputs the following:

sign_and_send_pubkey: signing failed for ED25519 
"/home/user/.ssh/id_ed25519" from agent: agent refused operation

Then the prompt of the remote system appears.

* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?

No idea what I could do other than report the bug.

* What outcome did you expect instead?

Clicking "no" leads to the SSH connection not getting established.

*** End of the template - remove these template lines ***


-- System Information:
Debian Release: trixie/sid
APT prefers testing
APT policy: (900, 'testing')
Architecture: arm64 (aarch64)
Foreign Architectures: amd64

Kernel: Linux 6.12.21-arm64 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_WARN
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ssh-askpass-gnome depends on:
ii libc6 2.41-6
ii libglib2.0-0t64 2.84.1-1
ii libgtk-3-0t64 3.24.49-3
ii openssh-client 1:9.9p2-2

ssh-askpass-gnome recommends no packages.

ssh-askpass-gnome suggests no packages.

-- no debconf information

-- 
erebion

XMPP: [email protected]

My languages: German, English, Swedish, Norwegian, Danish
Yes, I'm a language nerd. Feel free to write to me in any of the aforementioned languages.

-----BEGIN PGP PUBLIC KEY BLOCK-----

xjMEY7S2FRYJKwYBBAHaRw8BAQdAUf0YlT6sBQSunZeO44bgAPe+ndqTifGaNjw7
vzJ2KPHNHGVyZWJpb24gPGVyZWJpb25AZXJlYmlvbi5ldT7CjwQTFggANxYhBJyM
prURw7/YpjH7646vQDJuAq59BQJnd/p9BQkFo5fbAhsDBAsJCAcFFQgJCgsFFgID
AQAACgkQjq9AMm4Crn3+7gD/Xg4WlGKTVg+kTCc+NusDdHyWRs75m9y9ihwnUhbJ
hBEBAOsnX3CKIvjxoIAFwLuTg2kxZGZNgoUl4m5ZUyHScb8Mwo8EExYIADcWIQSc
jKa1EcO/2KYx++uOr0AybgKufQUCY7S2FQUJA8JnAAIbAwQLCQgHBRUICQoLBRYC
AwEAAAoJEI6vQDJuAq59M9gBANOVmMtWlN3pnDz/2HQ41CKXgIbWen8SUd4+0ibr
oqePAPwLwgNEdlfOt1iEAbf8aVsCW4sn414S3zy8/2gDDDayCc44BGO0thUSCisG
AQQBl1UBBQEBB0DejT1nMqinXnBlNbzfBVVwcGBFHTgIReY6ZnezNGG8fAMBCAfC
fgQYFggAJhYhBJyMprURw7/YpjH7646vQDJuAq59BQJnd/p9BQkFo5fbAhsMAAoJ
EI6vQDJuAq59iuoA/0GylFGDlE2xH9TwK2gMKRYn7f+EkC0l5Xqwvmj2i7TgAP92
UGYOI2U6cE9TNLYJM1RaebGkHMj6siYA0pwmy1DtBcJ+BBgWCAAmFiEEnIymtRHD
v9imMfvrjq9AMm4Crn0FAmO0thUFCQPCZwACGwwACgkQjq9AMm4Crn19+wD/XSiL
jRrZzagsTlJNRJ0crtgU0P2pYaI9cktceEq7QqMA/j7I2piZYJWpQ0yPg09NfEiI
LkzYg3nNzpx51c05pWEP
=pDN4
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----

wnsEABYIACMWIQScjKa1EcO/2KYx++uOr0AybgKufQUCaAV73wUDAAAAAAAKCRCOr0AybgKufeyW
AP9npmhaIVdMRrwI8V0GmqEVQEoZFkdTrQo8fh8vJBzNSQEA1qrWC14U57AA7glg/YI9vzX31zz3
E16KziZiw8qaWAE=
=sjqX
-----END PGP SIGNATURE-----