rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73281

Browse Source 
Fix misinteraction between agent locking and
the session-bind@openssh.com extension

Resolves: RHEL-245422

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-21 16:54:09 +02:00
parent 5baa4f88f8
commit 6a7c033e9a
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
openssh-10.5p1-CVE-2026-73281.patch Normal file
View File

@ -0,0 +1,42 @@
diff --git a/ssh-agent.c b/ssh-agent.c
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e)
error_fr(r, "parse");
goto send;
}
+
+ /*
+ * This function can be called while the agent is locked to allow
+ * session binds to be processed for new channels.
+ * Other operations should be refused when locked.
+ */
+
if (strcmp(name, "session-bind@openssh.com") == 0)
success = process_ext_session_bind(e);
+ else if (locked)
+ debug_f("attempt to use extension \"%s\" while locked", name);
else
debug_f("unsupported extension \"%s\"", name);
free(name);
@@ -1892,16 +1901,19 @@ process_message(u_int socknum)
/* check whether agent is locked */
if (locked && type != SSH_AGENTC_UNLOCK) {
- sshbuf_reset(e->request);
switch (type) {
case SSH2_AGENTC_REQUEST_IDENTITIES:
/* send empty lists */
no_identities(e);
break;
+ case SSH_AGENTC_EXTENSION:
+ process_extension(e);
+ break;
default:
/* send a fail message for all other request types */
send_status(e, 0);
}
+ sshbuf_reset(e->request);
return 1;
}

6
openssh.spec
View File

@ -276,6 +276,8 @@ Patch1049: openssh-10.4p1-CVE-2026-59995.patch
# combines CVE-2026-59999 and CVE-2026-73283
# downstream specific fix, drop on rebase
Patch1050: openssh-10.4p1-CVE-2026-59999.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1051: openssh-10.5p1-CVE-2026-73281.patch
License: BSD
@ -501,6 +503,7 @@ popd
%patch1048 -p1 -b .maxstartups-mistracking
%patch1049 -p1 -b .CVE-2026-59995
%patch1050 -p1 -b .CVE-2026-59999
%patch1051 -p1 -b .CVE-2026-73281
%patch100 -p1 -b .coverity
@ -795,6 +798,9 @@ test -f %{sysconfig_anaconda} && \
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-245414
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245422
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-12
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded