Unpatch Red Hat help message
This commit is contained in:
root
commit
5f060d05a8
51
openssh-9.9p1-copy-data-ext-self-copy.patch
Normal file
51
openssh-9.9p1-copy-data-ext-self-copy.patch
Normal file
@ -0,0 +1,51 @@
|
||||
diff --color -ruNp a/sftp-server.c b/sftp-server.c
|
||||
--- a/sftp-server.c 2026-07-17 16:23:12.293427062 +0200
|
||||
+++ b/sftp-server.c 2026-07-17 16:29:01.480535500 +0200
|
||||
@@ -1625,6 +1625,7 @@ process_extended_copy_data(u_int32_t id)
|
||||
u_int64_t len, read_off, read_len, write_off;
|
||||
int r, copy_until_eof, status = SSH2_FX_OP_UNSUPPORTED;
|
||||
size_t ret;
|
||||
+ struct stat st_read, st_write;
|
||||
|
||||
if ((r = get_handle(iqueue, &read_handle)) != 0 ||
|
||||
(r = sshbuf_get_u64(iqueue, &read_off)) != 0 ||
|
||||
@@ -1647,12 +1648,35 @@ process_extended_copy_data(u_int32_t id)
|
||||
} else
|
||||
copy_until_eof = 0;
|
||||
|
||||
+ /* Disallow reading & writing to the same handle, path or inode */
|
||||
read_fd = handle_to_fd(read_handle);
|
||||
write_fd = handle_to_fd(write_handle);
|
||||
-
|
||||
- /* Disallow reading & writing to the same handle or same path or dirs */
|
||||
- if (read_handle == write_handle || read_fd < 0 || write_fd < 0 ||
|
||||
- !strcmp(handle_to_name(read_handle), handle_to_name(write_handle))) {
|
||||
+ if (read_fd < 0 || write_fd < 0) {
|
||||
+ error_f("bad read or write fd");
|
||||
+ status = errno_to_portable(EBADF);
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (fstat(read_fd, &st_read) != 0) {
|
||||
+ status = errno_to_portable(errno);
|
||||
+ error_f("fstat read_fd failed: %s", strerror(errno));
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (fstat(write_fd, &st_write) != 0) {
|
||||
+ status = errno_to_portable(errno);
|
||||
+ error_f("fstat write_fd failed: %s", strerror(errno));
|
||||
+ goto out;
|
||||
+ }
|
||||
+ if (read_handle == write_handle ||
|
||||
+ !strcmp(handle_to_name(read_handle), handle_to_name(write_handle)) ||
|
||||
+ (st_read.st_dev != 0 && st_read.st_ino != 0 &&
|
||||
+ st_read.st_dev == st_write.st_dev &&
|
||||
+ st_read.st_ino == st_write.st_ino)) {
|
||||
+ error_f("refusing to read/write same file: "
|
||||
+ "read \"%s\" dev %lu ino %lu, write \"%s\" dev %lu ino %lu",
|
||||
+ handle_to_name(read_handle),
|
||||
+ (u_long)st_read.st_dev, (u_long)st_read.st_ino,
|
||||
+ handle_to_name(write_handle),
|
||||
+ (u_long)st_write.st_dev, (u_long)st_write.st_ino);
|
||||
status = SSH2_FX_FAILURE;
|
||||
goto out;
|
||||
}
|
||||
@ -111,7 +111,7 @@ diff --color -ruNp a/sshd_config.5 b/sshd_config.5
|
||||
.Cm yes .
|
||||
+.It Cm GSSAPIDelegateCredentials
|
||||
+Accept delegated credentials on the server side. The default is
|
||||
+.CM yes .
|
||||
+.Cm yes .
|
||||
.It Cm GSSAPIEnablek5users
|
||||
Specifies whether to look at .k5users file for GSSAPI authentication
|
||||
access control. Further details are described in
|
||||
|
||||
@ -170,7 +170,7 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
|
||||
|
||||
#include "ssh-gss.h"
|
||||
|
||||
@@ -87,6 +88,33 @@ ssh_gssapi_krb5_init(void)
|
||||
@@ -87,6 +88,42 @@ ssh_gssapi_krb5_init(void)
|
||||
return 1;
|
||||
}
|
||||
|
||||
@ -178,6 +178,10 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
|
||||
+ * one of indicators in the list of allowed/denied rules.
|
||||
+ * In case of the match, apply the decision from the rule.
|
||||
+ * In case of no indicator from the ticket matching the rule, deny
|
||||
+ *
|
||||
+ * Returns -1 on any negative match
|
||||
+ * Returns 1 on positive match and no negative matches
|
||||
+ * Returns 0 when no matches occurred
|
||||
+ */
|
||||
+
|
||||
+static int
|
||||
@ -187,18 +191,23 @@ diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
|
||||
+ u_int i;
|
||||
+ *matched = -1;
|
||||
+
|
||||
+ /* Check indicators */
|
||||
+ for (i = 0; client->indicators[i] != NULL; i++) {
|
||||
+ ret = match_pattern_list(client->indicators[i],
|
||||
+ options.gss_indicators, 1);
|
||||
+ /* negative or positive match */
|
||||
+ if (ret != 0) {
|
||||
+
|
||||
+ /* record first positive match */
|
||||
+ if (ret == 1 && *matched == -1)
|
||||
+ *matched = i;
|
||||
+ return ret;
|
||||
+
|
||||
+ /* deny rule matched, return negative */
|
||||
+ if (ret == -1) {
|
||||
+ *matched = i;
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
+ /* No rule matched */
|
||||
+ return 0;
|
||||
+ /* if there was a match, it was positive,
|
||||
+ * otherwise no match */
|
||||
+ return *matched != -1;
|
||||
+}
|
||||
+
|
||||
/* Check if this user is OK to login. This only works with krb5 - other
|
||||
|
||||
17
openssh.spec
17
openssh.spec
@ -43,7 +43,7 @@
|
||||
Summary: An open source implementation of SSH protocol version 2
|
||||
Name: openssh
|
||||
Version: %{openssh_ver}
|
||||
Release: 27%{?dist}.alma.1
|
||||
Release: 28%{?dist}.alma.1
|
||||
URL: http://www.openssh.com/portable.html
|
||||
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
|
||||
@ -256,6 +256,9 @@ Patch1044: openssh-9.9p1-proxyjump-username-validity-checks.patch
|
||||
Patch1045: openssh-9.9p1-scp-remote-glob.patch
|
||||
# upstream e8bdfb151a356d0171fea4194dd205fbb252be23
|
||||
Patch1046: openssh-9.9p1-cve-2026-60002.patch
|
||||
# upstream 8b05bbeb293c5f777915e37e9ed43a06fb8e7614
|
||||
# upstream 5a5e47740b6466d58242aca28b9e584bab4ccf1d
|
||||
Patch1047: openssh-9.9p1-copy-data-ext-self-copy.patch
|
||||
|
||||
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
|
||||
Requires: /sbin/nologin
|
||||
@ -466,6 +469,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
|
||||
%patch -P 1044 -p1 -b .proxyjump-username-validity-checks
|
||||
%patch -P 1045 -p1 -b .scp-remote-glob
|
||||
%patch -P 1046 -p1 -b .cve-2026-60002
|
||||
%patch -P 1047 -p1 -b .copy-data-ext-self-copy
|
||||
|
||||
%patch -P 100 -p1 -b .coverity
|
||||
|
||||
@ -746,9 +750,18 @@ test -f %{sysconfig_anaconda} && \
|
||||
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
|
||||
|
||||
%changelog
|
||||
* Thu Jul 16 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-27.alma.1
|
||||
* Wed Jul 22 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-28.alma.1
|
||||
- Unpatch Red Hat help message
|
||||
|
||||
* Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
|
||||
- Fix GSSAPI indicators check ignoring subsequent deny rules if
|
||||
allow rule matched first
|
||||
Resolves: RHEL-182151
|
||||
- Add default value for GSSAPIDelegateCredentials property in sshd_config manpage
|
||||
Resolves: RHEL-211135
|
||||
- Fix self-copy guard bypass in copy-data extension
|
||||
Resolves: RHEL-191388
|
||||
|
||||
* Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-27
|
||||
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
|
||||
FIPS known-group validation that leads to client-side denial of service
|
||||
|
||||
Loading…
Reference in New Issue
Block a user