rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73282

Browse Source 
Fix information disclosure and data corruption
via use-after-free in ssh client

Resolves: RHEL-248257

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-25 15:48:17 +02:00
parent 0e3383ecda
commit 5d355dc228
2 changed files with 60 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
openssh-8.0p1-CVE-2026-73282.patch Normal file
View File

@ -0,0 +1,51 @@
diff --color -ruNp a/ssh.c b/ssh.c
--- a/ssh.c 2026-08-25 15:38:18.115917218 +0200
+++ b/ssh.c 2026-08-25 15:44:36.797255562 +0200
@@ -1629,14 +1629,24 @@ fork_postauth(void)
fatal("daemon() failed: %.200s", strerror(errno));
}
+struct rfwd_confirm_ctx {
+ int fid;
+};
+
/* Callback for remote forward global requests */
static void
ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
{
- struct Forward *rfwd = (struct Forward *)ctxt;
+ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
+ struct Forward *rfwd;
u_int port;
int r;
+ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
+ fatal("%s: invalid forwarding ID %d", __func__, rctx->fid);
+ rfwd = &options.remote_forwards[rctx->fid];
+ freezero(rctx, sizeof(*rctx));
+
/* XXX verbose() on failure? */
debug("remote forward %s for: listen %s%s%d, connect %s:%d",
type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
@@ -1762,6 +1772,8 @@ ssh_init_forwarding(struct ssh *ssh, cha
/* Initiate remote TCP/IP port forwardings. */
for (i = 0; i < options.num_remote_forwards; i++) {
+ struct rfwd_confirm_ctx *rctx;
+
debug("Remote connections from %.200s:%d forwarded to "
"local address %.200s:%d",
(options.remote_forwards[i].listen_path != NULL) ?
@@ -1783,9 +1795,10 @@ ssh_init_forwarding(struct ssh *ssh, cha
logit("Warning: Could not request remote "
"forwarding.");
} else {
+ rctx = xcalloc(1, sizeof(*rctx));
+ rctx->fid = i;
client_register_global_confirm(
- ssh_confirm_remote_forward,
- &options.remote_forwards[i]);
+ ssh_confirm_remote_forward, rctx);
}
}

10
openssh.spec
View File

@ -66,7 +66,7 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 8.0p1
%global openssh_rel 32
%global openssh_rel 33
%global pam_ssh_agent_ver 0.10.3
%global pam_ssh_agent_rel 8
@ -317,6 +317,8 @@ Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch
Patch1030: openssh-8.0p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
Patch1031: openssh-8.0p1-CVE-2026-59999.patch
# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
Patch1032: openssh-8.0p1-CVE-2026-73282.patch
License: BSD
Group: Applications/Internet
@ -575,6 +577,7 @@ popd
%patch1029 -p1 -b .proxyjump-username-validity-checks
%patch1030 -p1 -b .cve-2026-59995
%patch1031 -p1 -b .cve-2026-59999
%patch1032 -p1 -b .CVE-2026-73282
autoreconf
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@ -860,6 +863,11 @@ getent passwd sshd >/dev/null || \
%endif
%changelog
* Tue Aug 25 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-33
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-248257
* Thu Aug 20 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-32
- Improve fix for CVE-2023-38408, avoid invoking constructors on dlopen()
Related: RHEL-234763