rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-59999: DisableForwarding=yes not overriding PermitTunnel

Browse Source 
Backport upstream fix (commit 8dfe7ed6) for CVE-2026-59999
where DisableForwarding=yes did not properly override
PermitTunnel=yes, allowing tunnel device forwarding requests
to be accepted when they should have been rejected. The fix
adds a check for options.disable_forwarding in the
server_request_tun() function in serverloop.c.

CVE: CVE-2026-59999
Upstream patches:
 - 8dfe7ed6e2.patch
Resolves: RHEL-236280

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-12 11:34:30 +00:00 committed by Dmitry Belyavskiy
parent 9faed41614
commit 39b074fc33
2 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
openssh-8.0p1-CVE-2026-59999.patch Normal file
View File

@ -0,0 +1,28 @@
From 5aace1d332f0f74e7a993f04f9ab4449d6a44cb1 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Sun, 31 May 2026 04:47:29 +0000
Subject: [PATCH] upstream: DisableForwarding=yes didn't override
PermitTunnel=yes
Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
Jevtic; ok markus@
OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
---
serverloop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/serverloop.c b/serverloop.c
index a0df04e..8838ef1 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -585,7 +585,8 @@ server_request_tun(struct ssh *ssh)
ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
return NULL;
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+ auth_opts->restricted) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;

6
openssh.spec
View File

@ -315,6 +315,8 @@ Patch1028: openssh-8.7p1-authorized-keys-principles-option.patch
Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch
# upstream 1b39f39657d2e58f8ec57341581a39bbf0be645b
Patch1030: openssh-8.0p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
Patch1031: openssh-8.0p1-CVE-2026-59999.patch
License: BSD
Group: Applications/Internet
@ -572,6 +574,7 @@ popd
%patch1028 -p1 -b .authorized-keys-principles-option
%patch1029 -p1 -b .proxyjump-username-validity-checks
%patch1030 -p1 -b .cve-2026-59995
%patch1031 -p1 -b .cve-2026-59999
autoreconf
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@ -861,6 +864,9 @@ getent passwd sshd >/dev/null || \
- CVE-2026-59995: Fix sftp download to server-controlled path when
performing download on the commandline
Resolves: RHEL-236324
- CVE-2026-59999: Fix DisableForwarding=yes not overriding
PermitTunnel=yes
Resolves: RHEL-236280
* Mon Jun 29 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-30
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during