From 89eae95cdcab34ca1117b8bd9cb44d37a591c262 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 13 May 2025 14:28:28 +0000 Subject: [PATCH] import UBI openssh-8.7p1-45.el9 --- ...nssh-8.7p1-allow-duplicate-subsystem.patch | 32 +++++++++ SOURCES/openssh-8.7p1-openssl-log.patch | 65 +++++++++++++++++ SOURCES/openssh-8.7p1-redhat-help.patch | 40 +++++++++++ SOURCES/openssh-9.9p2-error_processing.patch | 69 +++++++++++++++++++ SPECS/openssh.spec | 27 +++++++- 5 files changed, 232 insertions(+), 1 deletion(-) create mode 100644 SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch create mode 100644 SOURCES/openssh-8.7p1-openssl-log.patch create mode 100644 SOURCES/openssh-8.7p1-redhat-help.patch create mode 100644 SOURCES/openssh-9.9p2-error_processing.patch diff --git a/SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch b/SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch new file mode 100644 index 0000000..22fe73b --- /dev/null +++ b/SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch @@ -0,0 +1,32 @@ +diff --git a/servconf.c b/servconf.c +index e16f9e90fc71..a3779a9d86ee 100644 +--- a/servconf.c ++++ b/servconf.c +@@ -1942,13 +1942,22 @@ process_server_config_line_depth(ServerOptions *options, char *line, + fatal("%s line %d: %s missing argument.", + filename, linenum, keyword); + if (!*activep) { +- arg = argv_next(&ac, &av); ++ argv_consume(&ac); ++ break; ++ } ++ found = 0; ++ for (i = 0; i < options->num_subsystems; i++) { ++ if (strcmp(arg, options->subsystem_name[i]) == 0) { ++ found = 1; ++ break; ++ } ++ } ++ if (found) { ++ debug("%s line %d: Subsystem '%s' already defined.", ++ filename, linenum, arg); ++ argv_consume(&ac); + break; + } +- for (i = 0; i < options->num_subsystems; i++) +- if (strcmp(arg, options->subsystem_name[i]) == 0) +- fatal("%s line %d: Subsystem '%s' " +- "already defined.", filename, linenum, arg); + options->subsystem_name[options->num_subsystems] = xstrdup(arg); + arg = argv_next(&ac, &av); + if (!arg || *arg == '\0') diff --git a/SOURCES/openssh-8.7p1-openssl-log.patch b/SOURCES/openssh-8.7p1-openssl-log.patch new file mode 100644 index 0000000..9c9a3f5 --- /dev/null +++ b/SOURCES/openssh-8.7p1-openssl-log.patch @@ -0,0 +1,65 @@ +diff -up openssh-8.7p1/log.c.xxx openssh-8.7p1/log.c +--- openssh-8.7p1/log.c.xxx 2024-10-18 13:00:56.419560563 +0200 ++++ openssh-8.7p1/log.c 2024-10-18 13:22:35.954819016 +0200 +@@ -438,6 +438,26 @@ sshlog(const char *file, const char *fun + va_end(args); + } + ++#ifdef WITH_OPENSSL ++static int ++openssl_error_print_cb(const char *str, size_t len, void *u) ++{ ++ sshlogdirect(SYSLOG_LEVEL_DEBUG1, 0, "openssl error %s", str); ++ return 0; ++} ++#endif ++ ++void ++sshlog_openssl(int r) ++{ ++#ifdef WITH_OPENSSL ++ if (r != SSH_ERR_LIBCRYPTO_ERROR) return; ++ ++ ERR_print_errors_cb(openssl_error_print_cb, NULL); ++#endif ++ return; ++} ++ + void + sshlogdie(const char *file, const char *func, int line, int showfunc, + LogLevel level, const char *suffix, const char *fmt, ...) +diff -up openssh-8.7p1/log.h.xxx openssh-8.7p1/log.h +--- openssh-8.7p1/log.h.xxx 2024-10-18 12:56:18.944971946 +0200 ++++ openssh-8.7p1/log.h 2024-10-18 13:03:38.324351416 +0200 +@@ -71,6 +71,7 @@ void cleanup_exit(int) __attribute__((n + void sshlog(const char *, const char *, int, int, + LogLevel, const char *, const char *, ...) + __attribute__((format(printf, 7, 8))); ++void sshlog_openssl(int); + void sshlogv(const char *, const char *, int, int, + LogLevel, const char *, const char *, va_list); + void sshsigdie(const char *, const char *, int, int, +diff -up openssh-8.7p1/auth2-pubkey.c.yyy openssh-8.7p1/auth2-pubkey.c +--- openssh-8.7p1/auth2-pubkey.c.yyy 2024-10-18 13:27:00.709055845 +0200 ++++ openssh-8.7p1/auth2-pubkey.c 2024-10-18 13:27:31.638784460 +0200 +@@ -131,6 +131,7 @@ userauth_pubkey(struct ssh *ssh) + goto done; + } + if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) { ++ sshlog_openssl(r); + error_fr(r, "parse key"); + goto done; + } +diff -up openssh-8.7p1/dispatch.c.yyy openssh-8.7p1/dispatch.c +--- openssh-8.7p1/dispatch.c.yyy 2024-10-18 13:27:56.349366570 +0200 ++++ openssh-8.7p1/dispatch.c 2024-10-18 13:28:17.921874757 +0200 +@@ -130,6 +130,8 @@ ssh_dispatch_run_fatal(struct ssh *ssh, + { + int r; + +- if ((r = ssh_dispatch_run(ssh, mode, done)) != 0) ++ if ((r = ssh_dispatch_run(ssh, mode, done)) != 0) { ++ sshlog_openssl(r); + sshpkt_fatal(ssh, r, "%s", __func__); ++ } + } diff --git a/SOURCES/openssh-8.7p1-redhat-help.patch b/SOURCES/openssh-8.7p1-redhat-help.patch new file mode 100644 index 0000000..e71c824 --- /dev/null +++ b/SOURCES/openssh-8.7p1-redhat-help.patch @@ -0,0 +1,40 @@ +diff -up openssh-8.7p1/ssh.c.xxx openssh-8.7p1/ssh.c +--- openssh-8.7p1/ssh.c.xxx 2024-09-11 14:24:06.711088878 +0200 ++++ openssh-8.7p1/ssh.c 2024-09-11 14:35:12.883765718 +0200 +@@ -175,6 +175,16 @@ extern int muxserver_sock; + extern u_int muxclient_command; + + /* Prints a help message to the user. This function never returns. */ ++static void ++redhat_usage(void) ++{ ++ if(isatty(fileno(stderr))) { ++ fprintf(stderr, ++"\nYou can find some explanations for typical errors at this link:\n" ++" https://red.ht/support_rhel_ssh\n" ++ ); ++ } ++} + + static void + usage(void) +@@ -188,6 +196,7 @@ usage(void) + " [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n" + " [-w local_tun[:remote_tun]] destination [command]\n" + ); ++ redhat_usage(); + exit(255); + } + +@@ -1609,8 +1618,10 @@ main(int ac, char **av) + /* Open a connection to the remote host. */ + if (ssh_connect(ssh, host, host_arg, addrs, &hostaddr, options.port, + options.connection_attempts, +- &timeout_ms, options.tcp_keep_alive) != 0) ++ &timeout_ms, options.tcp_keep_alive) != 0) { ++ redhat_usage(); + exit(255); ++ } + + if (addrs != NULL) + freeaddrinfo(addrs); diff --git a/SOURCES/openssh-9.9p2-error_processing.patch b/SOURCES/openssh-9.9p2-error_processing.patch new file mode 100644 index 0000000..d42a370 --- /dev/null +++ b/SOURCES/openssh-9.9p2-error_processing.patch @@ -0,0 +1,69 @@ +diff --git a/krl.c b/krl.c +index e2efdf06..0d0f6953 100644 +--- a/krl.c ++++ b/krl.c +@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf) + break; + case KRL_SECTION_CERT_SERIAL_BITMAP: + if (rs->lo - bitmap_start > INT_MAX) { ++ r = SSH_ERR_INVALID_FORMAT; + error_f("insane bitmap gap"); + goto out; + } +@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp) + goto out; + + if ((krl = ssh_krl_init()) == NULL) { ++ r = SSH_ERR_ALLOC_FAIL; + error_f("alloc failed"); + goto out; + } +diff --git a/sshconnect2.c b/sshconnect2.c +index a69c4da1..1ee6000a 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) + options.required_rsa_size)) != 0) + fatal_r(r, "Bad server host key"); + if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, +- xxx_conn_info) == -1) ++ xxx_conn_info) != 0) + fatal("Host key verification failed."); + return 0; + } +@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + + if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) { + debug_f("server sent unknown pkalg %s", pkalg); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) { +@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + error("input_userauth_pk_ok: type mismatch " + "for decoded key (received %d, expected %d)", + key->type, pktype); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + +@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + SSH_FP_DEFAULT); + error_f("server replied with unknown key: %s %s", + sshkey_type(key), fp == NULL ? "" : fp); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + ident = format_identity(id); +diff --git a/sshsig.c b/sshsig.c +index 6e03c0b0..3da005d6 100644 +--- a/sshsig.c ++++ b/sshsig.c +@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum, + } + if ((principals = sshbuf_dup_string(nprincipals)) == NULL) { + error_f("buffer error"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + /* success */ diff --git a/SPECS/openssh.spec b/SPECS/openssh.spec index e69e53a..7fa9a25 100644 --- a/SPECS/openssh.spec +++ b/SPECS/openssh.spec @@ -47,7 +47,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.7p1 -%global openssh_rel 43 +%global openssh_rel 45 %global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_rel 5 @@ -293,6 +293,13 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c Patch1020: openssh-8.7p1-sigpipe.patch Patch1021: openssh-9.8p1-upstream-cve-2024-6387.patch +Patch1022: openssh-8.7p1-redhat-help.patch +Patch1023: openssh-8.7p1-openssl-log.patch +#upstream commit 52dfe3c72d98503d8b7c6f64fc7e19d685636c0b +Patch1024: openssh-8.7p1-allow-duplicate-subsystem.patch +# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2 +# upstream 0832aac79517611dd4de93ad0a83577994d9c907 +Patch1025: openssh-9.9p2-error_processing.patch License: BSD Requires: /sbin/nologin @@ -519,6 +526,10 @@ popd %patch1019 -p1 -b .cve-2023-51385 %patch1020 -p1 -b .earlypipe %patch1021 -p1 -b .cve-2024-6387 +%patch1022 -p1 -b .redhat-help +%patch1023 -p1 -b .openssl-log +%patch1024 -p1 -b .allow-dup-subsystem +%patch1025 -p1 -b .errcode_set autoreconf pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver} @@ -806,6 +817,20 @@ test -f %{sysconfig_anaconda} && \ %endif %changelog +* Tue Feb 18 2025 Dmitry Belyavskiy - 8.7p1-45 +- Fix missing error codes set and invalid error code checks in OpenSSH. It + prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS + is on (CVE-2025-26465). + Resolves: RHEL-78700 + +* Mon Oct 21 2024 Dmitry Belyavskiy - 8.7p1-44 +- Add extra help information on ssh early failure + Resolves: RHEL-33809 +- Provide details on crypto error instead of "error in libcrypto" + Resolves: RHEL-52293 +- Allow duplicate Subsystem directive + Resolves: RHEL-47112 + * Tue Jul 09 2024 Dmitry Belyavskiy - 8.7p1-43 - Possible remote code execution due to a race condition (CVE-2024-6409) Resolves: RHEL-45741