From 39b074fc339d59ee13a7e3c097ea7e17a3d94049 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 12 Aug 2026 11:34:30 +0000 Subject: [PATCH] Fix CVE-2026-59999: DisableForwarding=yes not overriding PermitTunnel Backport upstream fix (commit 8dfe7ed6) for CVE-2026-59999 where DisableForwarding=yes did not properly override PermitTunnel=yes, allowing tunnel device forwarding requests to be accepted when they should have been rejected. The fix adds a check for options.disable_forwarding in the server_request_tun() function in serverloop.c. CVE: CVE-2026-59999 Upstream patches: - https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753.patch Resolves: RHEL-236280 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- openssh-8.0p1-CVE-2026-59999.patch | 28 ++++++++++++++++++++++++++++ openssh.spec | 6 ++++++ 2 files changed, 34 insertions(+) create mode 100644 openssh-8.0p1-CVE-2026-59999.patch diff --git a/openssh-8.0p1-CVE-2026-59999.patch b/openssh-8.0p1-CVE-2026-59999.patch new file mode 100644 index 0000000..5b59a79 --- /dev/null +++ b/openssh-8.0p1-CVE-2026-59999.patch @@ -0,0 +1,28 @@ +From 5aace1d332f0f74e7a993f04f9ab4449d6a44cb1 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 31 May 2026 04:47:29 +0000 +Subject: [PATCH] upstream: DisableForwarding=yes didn't override + PermitTunnel=yes + +Reported independently by Huzaifa Sidhpurwala of Redhat and Marko +Jevtic; ok markus@ + +OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c +--- + serverloop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/serverloop.c b/serverloop.c +index a0df04e..8838ef1 100644 +--- a/serverloop.c ++++ b/serverloop.c +@@ -585,7 +585,8 @@ server_request_tun(struct ssh *ssh) + ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); + return NULL; + } +- if ((options.permit_tun & mode) == 0) { ++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding || ++ auth_opts->restricted) { + ssh_packet_send_debug(ssh, "Server has rejected tunnel device " + "forwarding"); + return NULL; diff --git a/openssh.spec b/openssh.spec index 725b23f..c57338e 100644 --- a/openssh.spec +++ b/openssh.spec @@ -315,6 +315,8 @@ Patch1028: openssh-8.7p1-authorized-keys-principles-option.patch Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch # upstream 1b39f39657d2e58f8ec57341581a39bbf0be645b Patch1030: openssh-8.0p1-CVE-2026-59995.patch +# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753 +Patch1031: openssh-8.0p1-CVE-2026-59999.patch License: BSD Group: Applications/Internet @@ -572,6 +574,7 @@ popd %patch1028 -p1 -b .authorized-keys-principles-option %patch1029 -p1 -b .proxyjump-username-validity-checks %patch1030 -p1 -b .cve-2026-59995 +%patch1031 -p1 -b .cve-2026-59999 autoreconf pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver} @@ -861,6 +864,9 @@ getent passwd sshd >/dev/null || \ - CVE-2026-59995: Fix sftp download to server-controlled path when performing download on the commandline Resolves: RHEL-236324 +- CVE-2026-59999: Fix DisableForwarding=yes not overriding + PermitTunnel=yes + Resolves: RHEL-236280 * Mon Jun 29 2026 Zoltan Fridrich - 8.0p1-30 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during