forked from rpms/openssh
import CS git openssh-8.0p1-28.el8_10
This commit is contained in:
AlmaLinux RelEng Bot
parent
8d2400298f
commit
237f16cee9
@ -1504,11 +1504,9 @@ index 2abbb9ef..569dc83f 100644
|
||||
kex_gen_hash(
|
||||
int hash_alg,
|
||||
const struct sshbuf *client_version,
|
||||
diff --git a/kexgssc.c b/kexgssc.c
|
||||
new file mode 100644
|
||||
index 00000000..0b2f6a56
|
||||
--- /dev/null
|
||||
+++ b/kexgssc.c
|
||||
diff --color -ruNp a/kexgssc.c b/kexgssc.c
|
||||
--- a/kexgssc.c 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ b/kexgssc.c 2026-03-16 15:43:01.131354176 +0100
|
||||
@@ -0,0 +1,618 @@
|
||||
+/*
|
||||
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
|
||||
@ -1564,8 +1562,8 @@ index 00000000..0b2f6a56
|
||||
+{
|
||||
+ struct kex *kex = ssh->kex;
|
||||
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
|
||||
+ recv_tok = GSS_C_EMPTY_BUFFER,
|
||||
+ gssbuf, msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
|
||||
+ recv_tok = GSS_C_EMPTY_BUFFER, gssbuf = GSS_C_EMPTY_BUFFER,
|
||||
+ msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
|
||||
+ Gssctxt *ctxt;
|
||||
+ OM_uint32 maj_status, min_status, ret_flags;
|
||||
+ struct sshbuf *server_blob = NULL;
|
||||
@ -1717,11 +1715,11 @@ index 00000000..0b2f6a56
|
||||
+ fatal("Failed to read token: %s", ssh_err(r));
|
||||
+ /* If we're already complete - protocol error */
|
||||
+ if (maj_status == GSS_S_COMPLETE)
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: received token when complete");
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: received token when complete");
|
||||
+ } else {
|
||||
+ /* No token included */
|
||||
+ if (maj_status != GSS_S_COMPLETE)
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: did not receive final token");
|
||||
+ }
|
||||
+ if ((r = sshpkt_get_end(ssh)) != 0) {
|
||||
+ fatal("Expecting end of packet.");
|
||||
@ -1737,7 +1735,7 @@ index 00000000..0b2f6a56
|
||||
+ fatal("sshpkt_get failed: %s", ssh_err(r));
|
||||
+ fatal("GSSAPI Error: \n%.400s", msg);
|
||||
+ default:
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: didn't expect packet type %d",
|
||||
+ type);
|
||||
+ }
|
||||
+ token_ptr = &recv_tok;
|
||||
@ -1810,7 +1808,7 @@ index 00000000..0b2f6a56
|
||||
+
|
||||
+ /* Verify that the hash matches the MIC we just got. */
|
||||
+ if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
|
||||
+ sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
|
||||
+ ssh_packet_disconnect(ssh, "Hash's MIC didn't verify");
|
||||
+
|
||||
+ gss_release_buffer(&min_status, &msg_tok);
|
||||
+
|
||||
@ -1842,8 +1840,8 @@ index 00000000..0b2f6a56
|
||||
+{
|
||||
+ struct kex *kex = ssh->kex;
|
||||
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER,
|
||||
+ recv_tok = GSS_C_EMPTY_BUFFER, gssbuf,
|
||||
+ msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
|
||||
+ recv_tok = GSS_C_EMPTY_BUFFER, gssbuf = GSS_C_EMPTY_BUFFER,
|
||||
+ msg_tok = GSS_C_EMPTY_BUFFER, *token_ptr;
|
||||
+ Gssctxt *ctxt;
|
||||
+ OM_uint32 maj_status, min_status, ret_flags;
|
||||
+ struct sshbuf *shared_secret = NULL;
|
||||
@ -2014,11 +2012,11 @@ index 00000000..0b2f6a56
|
||||
+ fatal("sshpkt failed: %s", ssh_err(r));
|
||||
+ /* If we're already complete - protocol error */
|
||||
+ if (maj_status == GSS_S_COMPLETE)
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: received token when complete");
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: received token when complete");
|
||||
+ } else {
|
||||
+ /* No token included */
|
||||
+ if (maj_status != GSS_S_COMPLETE)
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: did not receive final token");
|
||||
+ }
|
||||
+ break;
|
||||
+ case SSH2_MSG_KEXGSS_ERROR:
|
||||
@ -2031,7 +2029,7 @@ index 00000000..0b2f6a56
|
||||
+ fatal("sshpkt failed: %s", ssh_err(r));
|
||||
+ fatal("GSSAPI Error: \n%.400s", msg);
|
||||
+ default:
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: didn't expect packet type %d",
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: didn't expect packet type %d",
|
||||
+ type);
|
||||
+ }
|
||||
+ token_ptr = &recv_tok;
|
||||
@ -2093,7 +2091,7 @@ index 00000000..0b2f6a56
|
||||
+
|
||||
+ /* Verify that the hash matches the MIC we just got. */
|
||||
+ if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
|
||||
+ sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
|
||||
+ ssh_packet_disconnect(ssh, "Hash's MIC didn't verify");
|
||||
+
|
||||
+ gss_release_buffer(&min_status, &msg_tok);
|
||||
+
|
||||
@ -2128,11 +2126,9 @@ index 00000000..0b2f6a56
|
||||
+ return r;
|
||||
+}
|
||||
+#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
|
||||
diff --git a/kexgsss.c b/kexgsss.c
|
||||
new file mode 100644
|
||||
index 00000000..60bc02de
|
||||
--- /dev/null
|
||||
+++ b/kexgsss.c
|
||||
diff --color -ruNp a/kexgsss.c b/kexgsss.c
|
||||
--- a/kexgsss.c 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ b/kexgsss.c 2026-03-16 15:45:31.256395698 +0100
|
||||
@@ -0,0 +1,482 @@
|
||||
+/*
|
||||
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
|
||||
@ -2200,7 +2196,8 @@ index 00000000..60bc02de
|
||||
+ */
|
||||
+
|
||||
+ OM_uint32 ret_flags = 0;
|
||||
+ gss_buffer_desc gssbuf = {0, NULL}, recv_tok, msg_tok;
|
||||
+ gss_buffer_desc gssbuf = GSS_C_EMPTY_BUFFER,
|
||||
+ recv_tok = GSS_C_EMPTY_BUFFER, msg_tok = GSS_C_EMPTY_BUFFER;
|
||||
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
|
||||
+ Gssctxt *ctxt = NULL;
|
||||
+ struct sshbuf *shared_secret = NULL;
|
||||
@ -2304,7 +2301,7 @@ index 00000000..60bc02de
|
||||
+ fatal("sshpkt failed: %s", ssh_err(r));
|
||||
+ break;
|
||||
+ default:
|
||||
+ sshpkt_disconnect(ssh,
|
||||
+ ssh_packet_disconnect(ssh,
|
||||
+ "Protocol error: didn't expect packet type %d",
|
||||
+ type);
|
||||
+ }
|
||||
@ -2403,7 +2400,8 @@ index 00000000..60bc02de
|
||||
+ */
|
||||
+
|
||||
+ OM_uint32 ret_flags = 0;
|
||||
+ gss_buffer_desc gssbuf, recv_tok, msg_tok;
|
||||
+ gss_buffer_desc gssbuf = GSS_C_EMPTY_BUFFER,
|
||||
+ recv_tok = GSS_C_EMPTY_BUFFER, msg_tok = GSS_C_EMPTY_BUFFER;
|
||||
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
|
||||
+ Gssctxt *ctxt = NULL;
|
||||
+ struct sshbuf *shared_secret = NULL;
|
||||
@ -2459,10 +2457,8 @@ index 00000000..60bc02de
|
||||
+ fatal("GSS_GEX, bad parameters: %d !< %d !< %d",
|
||||
+ min, nbits, max);
|
||||
+ kex->dh = PRIVSEP(choose_dh(min, nbits, max));
|
||||
+ if (kex->dh == NULL) {
|
||||
+ sshpkt_disconnect(ssh, "Protocol error: no matching group found");
|
||||
+ fatal("Protocol error: no matching group found");
|
||||
+ }
|
||||
+ if (kex->dh == NULL)
|
||||
+ ssh_packet_disconnect(ssh, "Protocol error: no matching group found");
|
||||
+
|
||||
+ DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
|
||||
+ if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 ||
|
||||
@ -2500,7 +2496,7 @@ index 00000000..60bc02de
|
||||
+ fatal("sshpkt failed: %s", ssh_err(r));
|
||||
+ break;
|
||||
+ default:
|
||||
+ sshpkt_disconnect(ssh,
|
||||
+ ssh_packet_disconnect(ssh,
|
||||
+ "Protocol error: didn't expect packet type %d",
|
||||
+ type);
|
||||
+ }
|
||||
|
||||
@ -66,7 +66,7 @@
|
||||
|
||||
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
||||
%global openssh_ver 8.0p1
|
||||
%global openssh_rel 27
|
||||
%global openssh_rel 28
|
||||
%global pam_ssh_agent_ver 0.10.3
|
||||
%global pam_ssh_agent_rel 7
|
||||
|
||||
@ -836,6 +836,11 @@ getent passwd sshd >/dev/null || \
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Mar 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-28
|
||||
- CVE-2026-3497: Fix information disclosure or denial of service due
|
||||
to uninitialized variables in gssapi-keyex
|
||||
Resolves: RHEL-155814
|
||||
|
||||
* Wed Dec 10 2025 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-27
|
||||
- CVE-2025-61984: Reject usernames with control characters
|
||||
Resolves: RHEL-128400
|
||||
|
||||
Loading…
Reference in New Issue
Block a user