rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73283

Browse Source 
Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options

Resolves: RHEL-245414

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-21 16:51:38 +02:00
parent 137dded1ef
commit 5baa4f88f8
2 changed files with 73 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
openssh-10.4p1-CVE-2026-59999.patch
View File

@ -1,5 +1,69 @@
diff --git a/auth-options.c b/auth-options.c
index e15f600ab..c5fc4e59c 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void)
ret->permit_x11_forwarding_flag = 1;
ret->permit_pty_flag = 1;
ret->permit_user_rc = 1;
+ ret->permit_tun_flag = 1;
return ret;
}
@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
ret->permit_x11_forwarding_flag = 0;
ret->permit_pty_flag = 0;
ret->permit_user_rc = 0;
+ ret->permit_tun_flag = 0;
} else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
ret->cert_authority = r;
} else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
OPTFLAG_AND(permit_x11_forwarding_flag);
OPTFLAG_AND(permit_pty_flag);
OPTFLAG_AND(permit_user_rc);
+ OPTFLAG_AND(permit_tun_flag);
OPTFLAG_AND(no_require_user_presence);
/* Restrictive flags are logical-OR (i.e. must be set in either) */
OPTFLAG_OR(require_verify);
@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig)
OPTSCALAR(permit_x11_forwarding_flag);
OPTSCALAR(permit_pty_flag);
OPTSCALAR(permit_user_rc);
+ OPTSCALAR(permit_tun_flag);
OPTSCALAR(restricted);
OPTSCALAR(cert_authority);
OPTSCALAR(force_tun_device);
@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
(r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
(r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
(r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
OPT_FLAG(permit_x11_forwarding_flag);
OPT_FLAG(permit_pty_flag);
OPT_FLAG(permit_user_rc);
+ OPT_FLAG(permit_tun_flag);
OPT_FLAG(restricted);
OPT_FLAG(cert_authority);
OPT_FLAG(no_require_user_presence);
diff --git a/auth-options.h b/auth-options.h
index 6e29b727c..191b9b249 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -39,6 +39,7 @@ struct sshauthopt {
int permit_x11_forwarding_flag;
int permit_pty_flag;
int permit_user_rc;
+ int permit_tun_flag;
/* "restrict" keyword was invoked */
int restricted;
diff --git a/serverloop.c b/serverloop.c
index 8a6e3db80..9d8a3429e 100644
index 8a6e3db80..cf5243f80 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
@ -8,7 +72,7 @@ index 8a6e3db80..9d8a3429e 100644
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+ auth_opts->restricted) {
+ !auth_opts->permit_tun_flag) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;

8
openssh.spec
View File

@ -47,7 +47,7 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 9.9p1
%global openssh_rel 12
%global openssh_rel 13
%global pam_ssh_agent_ver 0.10.4
%global pam_ssh_agent_rel 10
@ -274,6 +274,7 @@ Patch1049: openssh-10.4p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
# combines CVE-2026-59999 and CVE-2026-73283
# downstream specific fix, drop on rebase
Patch1050: openssh-10.4p1-CVE-2026-59999.patch
@ -790,6 +791,11 @@ test -f %{sysconfig_anaconda} && \
%endif
%changelog
* Fri Aug 21 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-13
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-245414
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location