rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Unpatch Red Hat help message

Browse Source
This commit is contained in:
Koichiro Iwao 2026-08-14 03:00:39 +00:00 committed by root
commit 0ef92bf7d4
3 changed files with 52 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
openssh-10.4p1-CVE-2026-59995.patch Normal file
View File

@ -0,0 +1,20 @@
diff --git a/sftp.c b/sftp.c
index 0ab9206c2..0b57e0833 100644
--- a/sftp.c
+++ b/sftp.c
@@ -2289,13 +2289,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
return (-1);
}
} else {
- /* XXX this is wrong wrt quoting */
- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
- global_aflag ? " -a" : "", dir,
- file2 == NULL ? "" : " ",
- file2 == NULL ? "" : file2);
- err = parse_dispatch_command(conn, cmd,
- &remote_path, startdir, 1, 0);
+ err = process_get(conn, dir, file2, remote_path, 0, 0,
+ global_aflag, 0);
free(dir);
free(startdir);
free(remote_path);

14
openssh-10.4p1-CVE-2026-59999.patch Normal file
View File

@ -0,0 +1,14 @@
diff --git a/serverloop.c b/serverloop.c
index 8a6e3db80..9d8a3429e 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
return NULL;
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+ auth_opts->restricted) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;

20
openssh.spec
View File

@ -43,7 +43,7 @@
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
Release: 28%{?dist}.alma.1
Release: 29%{?dist}.alma.1
URL: http://www.openssh.com/portable.html
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@ -259,6 +259,12 @@ Patch1046: openssh-9.9p1-cve-2026-60002.patch
# upstream 8b05bbeb293c5f777915e37e9ed43a06fb8e7614
# upstream 5a5e47740b6466d58242aca28b9e584bab4ccf1d
Patch1047: openssh-9.9p1-copy-data-ext-self-copy.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1048: openssh-10.4p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
# combines CVE-2026-59999 and CVE-2026-73283
Patch1049: openssh-10.4p1-CVE-2026-59999.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -470,6 +476,8 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1045 -p1 -b .scp-remote-glob
%patch -P 1046 -p1 -b .cve-2026-60002
%patch -P 1047 -p1 -b .copy-data-ext-self-copy
%patch -P 1048 -p1 -b .CVE-2026-59995
%patch -P 1049 -p1 -b .CVE-2026-59999
%patch -P 100 -p1 -b .coverity
@ -750,9 +758,17 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
* Wed Jul 22 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-28.alma.1
* Fri Aug 14 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-29.alma.1
- Unpatch Red Hat help message
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location
Resolves: RHEL-236323
- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-236275
* Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
- Fix GSSAPI indicators check ignoring subsequent deny rules if
allow rule matched first