.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -1,36 +1,3 @@
-openssh-5.5p1-noacss.tar.bz2
+SOURCES/DJM-GPG-KEY.gpg
-pam_ssh_agent_auth-0.9.2.tar.bz2
+SOURCES/openssh-8.0p1.tar.gz
-/openssh-5.6p1-noacss.tar.bz2
+SOURCES/pam_ssh_agent_auth-0.10.3.tar.bz2
-/pam_ssh_agent_auth-0.9.2.tar.bz2
-/openssh-5.8p1-noacss.tar.bz2
-/openssh-5.8p2-noacss.tar.bz2
-/openssh-5.9p1-noacss.tar.bz2
-/pam_ssh_agent_auth-0.9.3.tar.bz2
-/openssh-6.0p1-noacss.tar.bz2
-/openssh-6.1p1-noacss.tar.bz2
-/openssh-6.2p1.tar.gz
-/openssh-6.2p2.tar.gz
-/openssh-6.3p1.tar.gz
-/openssh-6.4p1.tar.gz
-/openssh-6.6p1.tar.gz
-/openssh-6.7p1.tar.gz
-/openssh-6.8p1.tar.gz
-/openssh-6.9p1.tar.gz
-/openssh-7.0p1.tar.gz
-/openssh-7.1p1.tar.gz
-/openssh-7.1p2.tar.gz
-/pam_ssh_agent_auth-0.10.2.tar.bz2
-/openssh-7.2p1.tar.gz
-/openssh-7.2p2.tar.gz
-/openssh-7.3p1.tar.gz
-/openssh-7.4p1.tar.gz
-/pam_ssh_agent_auth-0.10.3.tar.bz2
-/openssh-7.5p1.tar.gz
-/openssh-7.6p1.tar.gz
-/openssh-7.7p1.tar.gz
-/openssh-7.7p1.tar.gz.asc
-/DJM-GPG-KEY.gpg
-/openssh-7.8p1.tar.gz
-/openssh-7.8p1.tar.gz.asc
-/openssh-8.0p1.tar.gz
-/openssh-8.0p1.tar.gz.asc

.openssh.metadata

@@ -0,0 +1,3 @@
+bed7240bb17840b451b8f8457791c33456814d93 SOURCES/DJM-GPG-KEY.gpg
+756dbb99193f9541c9206a667eaa27b0fa184a4f SOURCES/openssh-8.0p1.tar.gz
+a4482a050fdad1d012427e45799564136708cf6b SOURCES/pam_ssh_agent_auth-0.10.3.tar.bz2

SOURCES/openssh-8.0p1-CVE-2025-26465.patch

@@ -0,0 +1,57 @@
+diff --git a/openssh-8.0p1/krl.c b/openssh-8.0p1/krl.c
+index 8e2d5d5..e5b046d 100644
+--- a/openssh-8.0p1/krl.c
++++ b/openssh-8.0p1/krl.c
+@@ -676,6 +676,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
+ 			break;
+ 		case KRL_SECTION_CERT_SERIAL_BITMAP:
+ 			if (rs->lo - bitmap_start > INT_MAX) {
++				r = SSH_ERR_INVALID_FORMAT;
+ 				error("%s: insane bitmap gap", __func__);
+ 				goto out;
+ 			}
+@@ -1011,6 +1012,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
+ 		goto out;
+ 
+ 	if ((krl = ssh_krl_init()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
+ 		error("%s: alloc failed", __func__);
+ 		goto out;
+ 	}
+diff --git a/openssh-8.0p1/sshconnect2.c b/openssh-8.0p1/sshconnect2.c
+index ce855eb..9650b24 100644
+--- a/openssh-8.0p1/sshconnect2.c
++++ b/openssh-8.0p1/sshconnect2.c
+@@ -95,7 +95,7 @@ struct sockaddr *xxx_hostaddr;
+ static int
+ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ {
+-	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
++	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+ }
+@@ -767,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 
+ 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ 		debug("%s: server sent unknown pkalg %s", __func__, pkalg);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -777,6 +778,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		error("input_userauth_pk_ok: type mismatch "
+ 		    "for decoded key (received %d, expected %d)",
+ 		    key->type, pktype);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 
+@@ -796,6 +798,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+ 		    SSH_FP_DEFAULT);
+ 		error("%s: server replied with unknown key: %s %s", __func__,
+ 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	ident = format_identity(id);

SOURCES/openssh-8.0p1.tar.gz.asc

@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQHDBAABCgAdFiEEWcIRjtIG2SfmZ+vj0+X1a22SDTAFAly3ro8ACgkQ0+X1a22S
+DTCAiAx/W9XHoDs5NijyNIP43W2nFYuf6HG1duoLjdJ8rnsC3e90gx8h5RpUUh24
+JDACoUFnbJsNgiQBaYpO7bOnf3Vw5Oui1gPeKnQ76KQsXDwD/N/0wLUf55+XdNJ6
+tcgm6/x1W4b8bWje5bcS3qhxv6t/hSL/OxusA8zoNmnTD5XMg6QtJ0Rp9ZHPriCJ
+C4eCPdHfmyHCr1IATMX9+n5CO5JUPexaDjQug7k/Z1XA/UlwVfRRs1JMpviBodC+
+ZUOuk9tH11RKSBcUeR3Ef4iaR3FchryyyBZUZdYBkmDrnHrYpUK5ifdHT+ZXdzPl
+laX03Kz094LqrP6L3lafk6b1PKOVjKwx1vM5fhnv+pfx4dmao9BwZMuIq6Fa5uMX
+w2oHGhlIDmeT66Yny5d0APn2wCewyYUGPanSZY/HolHAPs+doOBgI361kMAR9J3e
+Ii3VKhIdE8i4K3fC19uDkf7xL8UVvRVXjgM7i+GNndh1ou/vDYxmEAsW9IR/D3XC
+HM/jMdq+UewAiRG46aI5rsi/A8J8/A==
+=YtoH
+-----END PGP SIGNATURE-----

SPECS/openssh.spec

@@ -66,7 +66,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.0p1
-%global openssh_rel 25
+%global openssh_rel 26
 %global pam_ssh_agent_ver 0.10.3
 %global pam_ssh_agent_rel 7
 
@@ -294,6 +294,8 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch
 Patch1020: openssh-8.7p1-scp-kill-switch.patch
 #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
 Patch1021: openssh-8.0p1-upstream-ignore-SIGPIPE.patch
+#upstream commit 0832aac79517611dd4de93ad0a83577994d9c907
+Patch1022: openssh-8.0p1-CVE-2025-26465.patch
 
 License: BSD
 Group: Applications/Internet
@@ -542,6 +544,7 @@ popd
 %patch1019 -p1 -b .cve-2023-51385
 %patch1020 -p1 -b .scp-kill-switch
 %patch1021 -p1 -b .ignore-SIGPIPE
+%patch1022 -p2 -b .cve-2025-26465
 
 autoreconf
 pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -827,6 +830,11 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
+* Wed Aug 20 2025 Antonio Vieiro <avieirov@redhat.com> - 8.0p1-26
+- Fix missing invalid error code checks in OpenSSH. It prevents
+  a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465)
+  Resolves: RHEL-109228
+
 * Tue Jun 25 2024 Stepan Broz <sbroz@redhat.com> - 8.0p1-25
 - Upstream: Ignore SIGPIPE earlier in main()
   Resolves: RHEL-37743

ci.fmf

@@ -1 +0,0 @@
-resultsdb-testcase: separate

gating.yaml

@@ -1,9 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-8
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-disabled-buildroot-enabled.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-enabled-buildroot-enabled.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-disabled-buildroot-disabled.functional}
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-enabled-buildroot-disabled.functional}