diff --git a/openssh-7.7p1-fips.patch b/openssh-7.7p1-fips.patch index 8d442a4..bc44ef3 100644 --- a/openssh-7.7p1-fips.patch +++ b/openssh-7.7p1-fips.patch @@ -106,17 +106,18 @@ diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c #include #include -@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32 - r = SSH_ERR_ALLOC_FAIL; - goto out; +@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32 } + p = g = NULL; /* belong to kex->dh now */ + + if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) { + r = SSH_ERR_INVALID_ARGUMENT; + goto out; + } - p = g = NULL; /* belong to kex->dh now */ - ++ /* generate and send 'e', client DH public key */ + if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0) + goto out; diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h --- openssh-8.6p1/myproposal.h.fips 2021-04-16 05:55:25.000000000 +0200 +++ openssh-8.6p1/myproposal.h 2021-05-06 12:08:36.498926877 +0200 diff --git a/openssh.spec b/openssh.spec index cbb2de7..72699f6 100644 --- a/openssh.spec +++ b/openssh.spec @@ -43,7 +43,7 @@ Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: 26%{?dist} +Release: 27%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -740,6 +740,11 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Fri Jun 26 2026 Zoltan Fridrich - 9.9p1-27 +- CVE-2026-55653: Fix double free in openssh DH-GEX client path during + FIPS known-group validation that leads to client-side denial of service + Resolves: RHEL-185776 + * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication Related: RHEL-92932