From 684fbae02b8e85e5f14e978201a3d5b68686d0fd Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Thu, 2 Apr 2026 07:39:57 +0000 Subject: upstream: add missing askpass check when using ControlMaster=ask/autoask and "ssh -O proxy ..."; reported by Michalis Vasileiadis OpenBSD-Commit-ID: 8dd7b9b96534e9a8726916b96d36bed466d3836a Upstream: https://salsa.debian.org/ssh-team/openssh/-/blob/bookworm/debian/patches/CVE-2026-35388.patch Upstream: https://anongit.mindrot.org/openssh.git/commit/?id=c805b97b67c774e0bf922ffb29dfbcda9d7b5add CVE: CVE-2026-35388 Signed-off-by: Thomas Perale --- mux.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/mux.c b/mux.c index e7580ac74..bda4015f4 100644 --- a/mux.c +++ b/mux.c @@ -1137,6 +1137,16 @@ mux_master_process_proxy(struct ssh *ssh, u_int rid, debug_f("channel %d: proxy request", c->self); + if (options.control_master == SSHCTL_MASTER_ASK || + options.control_master == SSHCTL_MASTER_AUTO_ASK) { + if (!ask_permission("Allow multiplex proxy connection?")) { + debug2_f("proxy refused by user"); + reply_error(reply, MUX_S_PERMISSION_DENIED, rid, + "Permission denied"); + return 0; + } + } + c->mux_rcb = channel_proxy_downstream; if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 || (r = sshbuf_put_u32(reply, rid)) != 0)