From 21f931db5912d31f42c0a4a7fa6be738253a2aa3 Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Tue, 14 Jul 2026 15:04:01 +0200
Subject: [PATCH] Fix CVE-2026-59996

Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs
remote-to-remote copy via the local host

Resolves: RHEL-193176

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
 openssh-9.9p1-scp-remote-glob.patch | 14 ++++++++++++++
 openssh.spec                        | 11 ++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 openssh-9.9p1-scp-remote-glob.patch

diff --git a/openssh-9.9p1-scp-remote-glob.patch b/openssh-9.9p1-scp-remote-glob.patch
new file mode 100644
index 0000000..c08101e
--- /dev/null
+++ b/openssh-9.9p1-scp-remote-glob.patch
@@ -0,0 +1,14 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c	2026-07-14 11:40:47.754600847 +0200
++++ b/scp.c	2026-07-14 11:43:04.077524517 +0200
+@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
+ 			goto out;
+ 		}
+ 
++		/* Special handling for source of '..' */
++		if (strcmp(filename, "..") == 0)
++			filename = "."; /* Download to dest, not dest/.. */
++
+ 		if (targetisdir)
+ 			abs_dst = sftp_path_append(target, filename);
+ 		else
diff --git a/openssh.spec b/openssh.spec
index 64802e1..470c2c8 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -47,7 +47,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 9.9p1
-%global openssh_rel 9
+%global openssh_rel 10
 %global pam_ssh_agent_ver 0.10.4
 %global pam_ssh_agent_rel 9
 
@@ -262,6 +262,8 @@ Patch1044: openssh-9.9p1-authorized-keys-principles-option.patch
 # upstream 607bd871ec029e9aa22e632a22547250f3cae223
 # upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
 Patch1045: openssh-9.9p1-proxyjump-username-validity-checks.patch
+# upstream 36480181fa22f98e180b4f9e10203480c0346c78
+Patch1046: openssh-9.9p1-scp-remote-glob.patch
 
 
 License: BSD
@@ -482,6 +484,7 @@ popd
 %patch1043 -p1 -b .ecdsa-incomplete-application
 %patch1044 -p1 -b .authorized-keys-principles-option
 %patch1045 -p1 -b .proxyjump-username-validity-checks
+%patch1046 -p1 -b .scp-remote-glob
 
 %patch100 -p1 -b .coverity
 
@@ -772,6 +775,12 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Tue Jul 14 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-10
+- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
+  in unintended parent directories when scp performs remote-to-remote copy
+  via the local host
+  Resolves: RHEL-193176
+
 * Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
   FIPS known-group validation that leads to client-side denial of service