EUVD-2018-3769

Malware in sbrugna...

curl: libssh backend CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 validation bypass

Summary: If libcurl is built against libssh CURLOPTSSHHOSTPUBLICKEYSHA256 is quietly ignored. As a result a SSH connection will be established even if the SHA256 key set doesn't match. Steps To Reproduce: 1. configure libcurl with libssh and build it 2. curl --hostpubsha256 HOSTFINGERPRINTHERE...