import UBI openssh-8.7p1-45.el9

SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch

@@ -0,0 +1,32 @@
+diff --git a/servconf.c b/servconf.c
+index e16f9e90fc71..a3779a9d86ee 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -1942,13 +1942,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+ 			fatal("%s line %d: %s missing argument.",
+ 			    filename, linenum, keyword);
+ 		if (!*activep) {
+-			arg = argv_next(&ac, &av);
++			argv_consume(&ac);
++			break;
++		}
++		found = 0;
++		for (i = 0; i < options->num_subsystems; i++) {
++			if (strcmp(arg, options->subsystem_name[i]) == 0) {
++				found = 1;
++				break;
++			}
++		}
++		if (found) {
++			debug("%s line %d: Subsystem '%s' already defined.",
++			    filename, linenum, arg);
++			argv_consume(&ac);
+ 			break;
+ 		}
+-		for (i = 0; i < options->num_subsystems; i++)
+-			if (strcmp(arg, options->subsystem_name[i]) == 0)
+-				fatal("%s line %d: Subsystem '%s' "
+-				    "already defined.", filename, linenum, arg);
+ 		options->subsystem_name[options->num_subsystems] = xstrdup(arg);
+ 		arg = argv_next(&ac, &av);
+ 		if (!arg || *arg == '\0')

SOURCES/openssh-8.7p1-openssl-log.patch

@@ -0,0 +1,65 @@
+diff -up openssh-8.7p1/log.c.xxx openssh-8.7p1/log.c
+--- openssh-8.7p1/log.c.xxx	2024-10-18 13:00:56.419560563 +0200
++++ openssh-8.7p1/log.c	2024-10-18 13:22:35.954819016 +0200
+@@ -438,6 +438,26 @@ sshlog(const char *file, const char *fun
+ 	va_end(args);
+ }
+ 
++#ifdef WITH_OPENSSL
++static int
++openssl_error_print_cb(const char *str, size_t len, void *u)
++{
++	sshlogdirect(SYSLOG_LEVEL_DEBUG1, 0, "openssl error %s", str);
++	return 0;
++}
++#endif
++
++void
++sshlog_openssl(int r)
++{
++#ifdef WITH_OPENSSL
++	if (r != SSH_ERR_LIBCRYPTO_ERROR) return;
++
++	ERR_print_errors_cb(openssl_error_print_cb, NULL);
++#endif
++	return;
++}
++
+ void
+ sshlogdie(const char *file, const char *func, int line, int showfunc,
+     LogLevel level, const char *suffix, const char *fmt, ...)
+diff -up openssh-8.7p1/log.h.xxx openssh-8.7p1/log.h
+--- openssh-8.7p1/log.h.xxx	2024-10-18 12:56:18.944971946 +0200
++++ openssh-8.7p1/log.h	2024-10-18 13:03:38.324351416 +0200
+@@ -71,6 +71,7 @@ void	 cleanup_exit(int) __attribute__((n
+ void	 sshlog(const char *, const char *, int, int,
+     LogLevel, const char *, const char *, ...)
+     __attribute__((format(printf, 7, 8)));
++void	 sshlog_openssl(int);
+ void	 sshlogv(const char *, const char *, int, int,
+     LogLevel, const char *, const char *, va_list);
+ void	 sshsigdie(const char *, const char *, int, int,
+diff -up openssh-8.7p1/auth2-pubkey.c.yyy openssh-8.7p1/auth2-pubkey.c
+--- openssh-8.7p1/auth2-pubkey.c.yyy	2024-10-18 13:27:00.709055845 +0200
++++ openssh-8.7p1/auth2-pubkey.c	2024-10-18 13:27:31.638784460 +0200
+@@ -131,6 +131,7 @@ userauth_pubkey(struct ssh *ssh)
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
++		sshlog_openssl(r);
+ 		error_fr(r, "parse key");
+ 		goto done;
+ 	}
+diff -up openssh-8.7p1/dispatch.c.yyy openssh-8.7p1/dispatch.c
+--- openssh-8.7p1/dispatch.c.yyy	2024-10-18 13:27:56.349366570 +0200
++++ openssh-8.7p1/dispatch.c	2024-10-18 13:28:17.921874757 +0200
+@@ -130,6 +130,8 @@ ssh_dispatch_run_fatal(struct ssh *ssh,
+ {
+ 	int r;
+ 
+-	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0)
++	if ((r = ssh_dispatch_run(ssh, mode, done)) != 0) {
++		sshlog_openssl(r);
+ 		sshpkt_fatal(ssh, r, "%s", __func__);
++	}
+ }

SOURCES/openssh-8.7p1-redhat-help.patch

@@ -0,0 +1,40 @@
+diff -up openssh-8.7p1/ssh.c.xxx openssh-8.7p1/ssh.c
+--- openssh-8.7p1/ssh.c.xxx	2024-09-11 14:24:06.711088878 +0200
++++ openssh-8.7p1/ssh.c	2024-09-11 14:35:12.883765718 +0200
+@@ -175,6 +175,16 @@ extern int muxserver_sock;
+ extern u_int muxclient_command;
+ 
+ /* Prints a help message to the user.  This function never returns. */
++static void
++redhat_usage(void)
++{
++    if(isatty(fileno(stderr))) {
++	fprintf(stderr,
++"\nYou can find some explanations for typical errors at this link:\n"
++"	    https://red.ht/support_rhel_ssh\n"
++	);
++    }
++}
+ 
+ static void
+ usage(void)
+@@ -188,6 +196,7 @@ usage(void)
+ "           [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n"
+ "           [-w local_tun[:remote_tun]] destination [command]\n"
+ 	);
++	redhat_usage();
+ 	exit(255);
+ }
+ 
+@@ -1609,8 +1618,10 @@ main(int ac, char **av)
+ 	/* Open a connection to the remote host. */
+ 	if (ssh_connect(ssh, host, host_arg, addrs, &hostaddr, options.port,
+ 	    options.connection_attempts,
+-	    &timeout_ms, options.tcp_keep_alive) != 0)
++	    &timeout_ms, options.tcp_keep_alive) != 0) {
++		redhat_usage();
+ 		exit(255);
++	}
+ 
+ 	if (addrs != NULL)
+ 		freeaddrinfo(addrs);

SOURCES/openssh-9.9p2-error_processing.patch

@@ -0,0 +1,69 @@
+diff --git a/krl.c b/krl.c
+index e2efdf06..0d0f6953 100644
+--- a/krl.c
++++ b/krl.c
+@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
+ 			break;
+ 		case KRL_SECTION_CERT_SERIAL_BITMAP:
+ 			if (rs->lo - bitmap_start > INT_MAX) {
++				r = SSH_ERR_INVALID_FORMAT;
+ 				error_f("insane bitmap gap");
+ 				goto out;
+ 			}
+@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
+ 		goto out;
+ 
+ 	if ((krl = ssh_krl_init()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
+ 		error_f("alloc failed");
+ 		goto out;
+ 	}
+diff --git a/sshconnect2.c b/sshconnect2.c
+index a69c4da1..1ee6000a 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ 	    options.required_rsa_size)) != 0)
+ 		fatal_r(r, "Bad server host key");
+ 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+-	    xxx_conn_info) == -1)
++	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+ }
+@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 
+ 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ 		debug_f("server sent unknown pkalg %s", pkalg);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		error("input_userauth_pk_ok: type mismatch "
+ 		    "for decoded key (received %d, expected %d)",
+ 		    key->type, pktype);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 
+@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		    SSH_FP_DEFAULT);
+ 		error_f("server replied with unknown key: %s %s",
+ 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	ident = format_identity(id);
+diff --git a/sshsig.c b/sshsig.c
+index 6e03c0b0..3da005d6 100644
+--- a/sshsig.c
++++ b/sshsig.c
+@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum,
+ 	}
+ 	if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
+ 		error_f("buffer error");
++		r = SSH_ERR_ALLOC_FAIL;
+ 		goto out;
+ 	}
+ 	/* success */

SPECS/openssh.spec

@@ -47,7 +47,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.7p1
-%global openssh_rel 43
+%global openssh_rel 45
 %global pam_ssh_agent_ver 0.10.4
 %global pam_ssh_agent_rel 5
 
@@ -293,6 +293,13 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch
 #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
 Patch1020: openssh-8.7p1-sigpipe.patch
 Patch1021: openssh-9.8p1-upstream-cve-2024-6387.patch
+Patch1022: openssh-8.7p1-redhat-help.patch
+Patch1023: openssh-8.7p1-openssl-log.patch
+#upstream commit 52dfe3c72d98503d8b7c6f64fc7e19d685636c0b
+Patch1024: openssh-8.7p1-allow-duplicate-subsystem.patch
+# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
+# upstream 0832aac79517611dd4de93ad0a83577994d9c907
+Patch1025: openssh-9.9p2-error_processing.patch
 
 License: BSD
 Requires: /sbin/nologin
@@ -519,6 +526,10 @@ popd
 %patch1019 -p1 -b .cve-2023-51385
 %patch1020 -p1 -b .earlypipe
 %patch1021 -p1 -b .cve-2024-6387
+%patch1022 -p1 -b .redhat-help
+%patch1023 -p1 -b .openssl-log
+%patch1024 -p1 -b .allow-dup-subsystem
+%patch1025 -p1 -b .errcode_set
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -806,6 +817,20 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Tue Feb 18 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
+- Fix missing error codes set and invalid error code checks in OpenSSH. It
+  prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
+  is on (CVE-2025-26465).
+  Resolves: RHEL-78700
+
+* Mon Oct 21 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-44
+- Add extra help information on ssh early failure
+  Resolves: RHEL-33809
+- Provide details on crypto error instead of "error in libcrypto"
+  Resolves: RHEL-52293
+- Allow duplicate Subsystem directive
+  Resolves: RHEL-47112
+
 * Tue Jul 09 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-43
 - Possible remote code execution due to a race condition (CVE-2024-6409)
   Resolves: RHEL-45741