From adca486c125d9a6d9565b9607a19dce803a8b479 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 24 Dec 2025 17:47:03 +0100
Subject: [PATCH] libssh: set both knownhosts options to the same file

Reported-by: Harry Sintonen

Closes #20092

CVE: CVE-2025-15079
Upstream-Status: Backport [https://github.com/curl/curl/commit/adca486c125d9a6d9565b9607a19dce803a8b479]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 lib/vssh/libssh.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
index 7d5905c83d..98c109ab59 100644
--- a/lib/vssh/libssh.c
+++ b/lib/vssh/libssh.c
@@ -2670,6 +2670,11 @@ static CURLcode myssh_connect(struct Curl_easy *data, bool *done)
     infof(data, "Known hosts: %s", data->set.str[STRING_SSH_KNOWNHOSTS]);
     rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_KNOWNHOSTS,
                          data->set.str[STRING_SSH_KNOWNHOSTS]);
+    if(rc == SSH_OK)
+      /* libssh has two separate options for this. Set both to the same file
+         to avoid surprises */
+      rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_GLOBAL_KNOWNHOSTS,
+                           data->set.str[STRING_SSH_KNOWNHOSTS]);
     if(rc != SSH_OK) {
       failf(data, "Could not set known hosts file path");
       return CURLE_FAILED_INIT;
