Bug#1134814: upstream fix

--0000000000001b508506540d49df
Content-Type: text/plain; charset="UTF-8"

Hi, I checked, and it seems that this has been applied in the upstream
OpenSSH project

commit cf6c0b3b94cdc223f1b8be1ef2d93e993af5d976
Author: [email protected] <[email protected]>
Date:   Wed May 13 05:11:02 2026 +0000

    upstream: fix hard-to-reach NULL deref during pubkey auth

    To hit this, the user must be using a PEM style private key with no
    corresponding .pub key adjacent to it.

    OpenBSD-Commit-ID: b7150acc5322fa33f21491834d9471fbe3d30f20

diff --git a/sshconnect2.c b/sshconnect2.c
index 478a9a52f..5a48c73ed 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.385 2026/04/02 07:48:13 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.386 2026/05/13 05:11:02 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -1277,7 +1277,7 @@ identity_sign(struct identity *id, u_char **sigp,
size_t *lenp,
         * PKCS#11 tokens may not support all signature algorithms,
         * so check what we get back.
         */
-       if ((id->key->flags & SSHKEY_FLAG_EXT) != 0 &&
+       if (id->key != NULL && (id->key->flags & SSHKEY_FLAG_EXT) != 0 &&
            (r = sshkey_check_sigtype(*sigp, *lenp, alg)) != 0) {
                debug_fr(r, "sshkey_check_sigtype");
                goto out;

Cheers Alejandro

--0000000000001b508506540d49df
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi, I checked, and it seems that this has been applie=
d in the upstream OpenSSH project</div><div><br></div><div>commit cf6c0b3b9=
4cdc223f1b8be1ef2d93e993af5d976<br>Author: <a href=3D"mailto:[email protected]=
g">[email protected]</a> &lt;<a href=3D"mailto:[email protected]">[email protected]=
rg</a>&gt;<br>Date: =C2=A0 Wed May 13 05:11:02 2026 +0000<br><br>=C2=A0 =C2=
=A0 upstream: fix hard-to-reach NULL deref during pubkey auth<br><br>=C2=A0=
 =C2=A0 To hit this, the user must be using a PEM style private key with no=
<br>=C2=A0 =C2=A0 corresponding .pub key adjacent to it.<br><br>=C2=A0 =C2=
=A0 OpenBSD-Commit-ID: b7150acc5322fa33f21491834d9471fbe3d30f20<br><br>diff=
 --git a/sshconnect2.c b/sshconnect2.c<br>index 478a9a52f..5a48c73ed 100644=
<br>--- a/sshconnect2.c<br>+++ b/sshconnect2.c<br>@@ -1,4 +1,4 @@<br>-/* $O=
penBSD: sshconnect2.c,v 1.385 2026/04/02 07:48:13 djm Exp $ */<br>+/* $Open=
BSD: sshconnect2.c,v 1.386 2026/05/13 05:11:02 djm Exp $ */<br>=C2=A0/*<br>=
=C2=A0 * Copyright (c) 2000 Markus Friedl.=C2=A0 All rights reserved.<br>=
=C2=A0 * Copyright (c) 2008 Damien Miller.=C2=A0 All rights reserved.<br>@@=
 -1277,7 +1277,7 @@ identity_sign(struct identity *id, u_char **sigp, size_=
t *lenp,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0* PKCS#11 tokens may not supp=
ort all signature algorithms,<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0* so che=
ck what we get back.<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*/<br>- =C2=A0 =
=C2=A0 =C2=A0 if ((id-&gt;key-&gt;flags &amp; SSHKEY_FLAG_EXT) !=3D 0 &amp;=
&amp;<br>+ =C2=A0 =C2=A0 =C2=A0 if (id-&gt;key !=3D NULL &amp;&amp; (id-&gt=
;key-&gt;flags &amp; SSHKEY_FLAG_EXT) !=3D 0 &amp;&amp;<br>=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 (r =3D sshkey_check_sigtype(*sigp, *lenp, alg))=
 !=3D 0) {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 debug=
_fr(r, &quot;sshkey_check_sigtype&quot;);<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 goto out;</div><div><br></div>Cheers Alejandro<=
/div>

--0000000000001b508506540d49df--