File curl-CVE-2025-15079.patch of Package curl.42129

From adca486c125d9a6d9565b9607a19dce803a8b479 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 24 Dec 2025 17:47:03 +0100
Subject: [PATCH] libssh: set both knownhosts options to the same file

Reported-by: Harry Sintonen

Closes #20092
---
 lib/vssh/libssh.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
index 7d5905c83d75..98c109ab59a3 100644
--- a/lib/vssh/libssh.c
+++ b/lib/vssh/libssh.c
@@ -2629,6 +2629,11 @@ static CURLcode myssh_connect(struct Curl_easy *data, bool *done)
     infof(data, "Known hosts: %s", data->set.str[STRING_SSH_KNOWNHOSTS]);
     rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_KNOWNHOSTS,
                          data->set.str[STRING_SSH_KNOWNHOSTS]);
+    if(rc == SSH_OK)
+      /* libssh has two separate options for this. Set both to the same file
+         to avoid surprises */
+      rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_GLOBAL_KNOWNHOSTS,
+                           data->set.str[STRING_SSH_KNOWNHOSTS]);
     if(rc != SSH_OK) {
       failf(data, "Could not set known hosts file path");
       return CURLE_FAILED_INIT;