rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect

Browse Source 
...handling of forwarding and tunneling options

Resolves: RHEL-236275
This commit is contained in:
Dmitry Belyavskiy 2026-08-12 13:30:43 +02:00
parent ab99bff6e8
commit 5dc3c53a89
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
openssh-10.4p1-CVE-2026-59999.patch Normal file
View File

@ -0,0 +1,14 @@
diff --git a/serverloop.c b/serverloop.c
index 8a6e3db80..9d8a3429e 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
return NULL;
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+ auth_opts->restricted) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;

8
openssh.spec
View File

@ -261,6 +261,10 @@ Patch1046: openssh-9.9p1-cve-2026-60002.patch
Patch1047: openssh-9.9p1-copy-data-ext-self-copy.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1048: openssh-10.4p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
# combines CVE-2026-59999 and CVE-2026-73283
Patch1049: openssh-10.4p1-CVE-2026-59999.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -473,6 +477,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1046 -p1 -b .cve-2026-60002
%patch -P 1047 -p1 -b .copy-data-ext-self-copy
%patch -P 1048 -p1 -b .CVE-2026-59995
%patch -P 1049 -p1 -b .CVE-2026-59999
%patch -P 100 -p1 -b .coverity
@ -757,6 +762,9 @@ test -f %{sysconfig_anaconda} && \
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location
Resolves: RHEL-236323
- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-236275
* Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
- Fix GSSAPI indicators check ignoring subsequent deny rules if