rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix GSSAPI indicators check ignoring subsequent deny rules if allow rule matched first

Browse Source 
Resolves: RHEL-182151

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-07-16 16:05:59 +02:00
parent 1c775f8203
commit 116c684a9e
2 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
View File

@ -170,7 +170,7 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
#include "ssh-gss.h"
@@ -87,6 +88,33 @@ ssh_gssapi_krb5_init(void)
@@ -87,6 +88,42 @@ ssh_gssapi_krb5_init(void)
return 1;
}
@ -178,6 +178,10 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
+ * one of indicators in the list of allowed/denied rules.
+ * In case of the match, apply the decision from the rule.
+ * In case of no indicator from the ticket matching the rule, deny
+ *
+ * Returns -1 on any negative match
+ * Returns 1 on positive match and no negative matches
+ * Returns 0 when no matches occurred
+ */
+
+static int
@ -187,18 +191,23 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
+ u_int i;
+ *matched = -1;
+
+ /* Check indicators */
+ for (i = 0; client->indicators[i] != NULL; i++) {
+ ret = match_pattern_list(client->indicators[i],
+ options.gss_indicators, 1);
+ /* negative or positive match */
+ if (ret != 0) {
+
+ /* record first positive match */
+ if (ret == 1 && *matched == -1)
+ *matched = i;
+ return ret;
+
+ /* deny rule matched, return negative */
+ if (ret == -1) {
+ *matched = i;
+ return -1;
+ }
+ }
+ /* No rule matched */
+ return 0;
+ /* if there was a match, it was positive,
+ * otherwise no match */
+ return *matched != -1;
+}
+
/* Check if this user is OK to login. This only works with krb5 - other

7
openssh.spec
View File

@ -43,7 +43,7 @@
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
Release: 27%{?dist}
Release: 28%{?dist}
URL: http://www.openssh.com/portable.html
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@ -746,6 +746,11 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
* Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
- Fix GSSAPI indicators check ignoring subsequent deny rules if
allow rule matched first
Resolves: RHEL-182151
* Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-27
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
FIPS known-group validation that leads to client-side denial of service