rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73282

Browse Source 
Fix information disclosure and data corruption
via use-after-free in ssh client

Resolves: RHEL-245420

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-21 16:55:34 +02:00
parent 6a7c033e9a
commit 3bc559dba4
2 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
openssh-10.5p1-CVE-2026-73282.patch Normal file
View File

@ -0,0 +1,51 @@
diff --git a/ssh.c b/ssh.c
--- a/ssh.c
+++ b/ssh.c
@@ -1862,14 +1862,24 @@
}
}
+struct rfwd_confirm_ctx {
+ int fid;
+};
+
/* Callback for remote forward global requests */
static void
ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
{
- struct Forward *rfwd = (struct Forward *)ctxt;
+ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
+ struct Forward *rfwd;
u_int port;
int r;
+ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
+ fatal_f("invalid forwarding ID %d", rctx->fid);
+ rfwd = &options.remote_forwards[rctx->fid];
+ freezero(rctx, sizeof(*rctx));
+
/* XXX verbose() on failure? */
debug("remote forward %s for: listen %s%s%d, connect %s:%d",
type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
@@ -2047,6 +2057,8 @@
/* Initiate remote TCP/IP port forwardings. */
for (i = 0; i < options.num_remote_forwards; i++) {
+ struct rfwd_confirm_ctx *rctx;
+
debug("Remote connections from %.200s:%d forwarded to "
"local address %.200s:%d",
(options.remote_forwards[i].listen_path != NULL) ?
@@ -2061,9 +2073,10 @@
if ((options.remote_forwards[i].handle =
channel_request_remote_forwarding(ssh,
&options.remote_forwards[i])) >= 0) {
+ rctx = xcalloc(1, sizeof(*rctx));
+ rctx->fid = i;
client_register_global_confirm(
- ssh_confirm_remote_forward,
- &options.remote_forwards[i]);
+ ssh_confirm_remote_forward, rctx);
forward_confirms_pending++;
} else if (options.exit_on_forward_failure)
fatal("Could not request remote forwarding.");

6
openssh.spec
View File

@ -278,6 +278,8 @@ Patch1049: openssh-10.4p1-CVE-2026-59995.patch
Patch1050: openssh-10.4p1-CVE-2026-59999.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1051: openssh-10.5p1-CVE-2026-73281.patch
# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
Patch1052: openssh-10.5p1-CVE-2026-73282.patch
License: BSD
@ -504,6 +506,7 @@ popd
%patch1049 -p1 -b .CVE-2026-59995
%patch1050 -p1 -b .CVE-2026-59999
%patch1051 -p1 -b .CVE-2026-73281
%patch1052 -p1 -b .CVE-2026-73282
%patch100 -p1 -b .coverity
@ -801,6 +804,9 @@ test -f %{sysconfig_anaconda} && \
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245422
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-245420
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded