Fixed bug where algorithm added in OpenSSH 10.x was being recommended for OpenSSH 9.x targets.

src/ssh_audit/algorithms.py

@@ -117,8 +117,6 @@ class Algorithms:
             sshv, alg_db = alg_pair.sshv, alg_pair.db
             rec[sshv] = {}
             for alg_type, alg_list in alg_pair.items():
-                if alg_type == 'aut':
-                    continue
                 rec[sshv][alg_type] = {'add': {}, 'del': {}, 'chg': {}}
                 for n, alg_desc in alg_db[alg_type].items():
                     versions = alg_desc[0]

src/ssh_audit/software.py

@@ -72,10 +72,29 @@ class Software:
             oversion, opatch = mx.group(1), mx.group(2).strip()
         else:
             oversion, opatch = other, ''
-        if self.version < oversion:
+
-            return -1
+        # Attempt to parse the versions into floats.
-        elif self.version > oversion:
+        float_parse_error = False
-            return 1
+        selfversion_float = 0.0
+        oversion_float = 0.0
+        try:
+            selfversion_float = float(self.version)
+            oversion_float = float(oversion)
+        except ValueError:
+            float_parse_error = True
+
+        # If the versions could not be parsed into floats, use the old string compare method. This returns incorrect results when comparing modern OpenSSH versions ("9.6" > "10.4" evaluates to True!), but removing this may trigger other bugs, and we have no other good options here, soooo...
+        if float_parse_error:
+            if self.version < oversion:
+                return -1
+            elif self.version > oversion:
+                return 1
+        else:  # Float parsing worked, so we'll use this instead. That way (9.6 > 10.4) properly evaluates to False.
+            if selfversion_float < oversion_float:  # pylint: disable=else-if-used
+                return -1
+            elif selfversion_float > oversion_float:
+                return 1
+
         spatch = self.patch or ''
         if self.product == Product.DropbearSSH:
             if not re.match(r'^test\d.*$', opatch):