rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73282

Browse Source 
Fix information disclosure and data corruption
via use-after-free in ssh client

Resolves: RHEL-245417

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-21 13:03:04 +02:00
parent 8fe12bdb0f
commit 74e87d59a4
2 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
openssh-10.5p1-CVE-2026-73282.patch Normal file
View File

@ -0,0 +1,51 @@
diff --git a/ssh.c b/ssh.c
--- a/ssh.c
+++ b/ssh.c
@@ -1862,14 +1862,24 @@
}
}
+struct rfwd_confirm_ctx {
+ int fid;
+};
+
/* Callback for remote forward global requests */
static void
ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
{
- struct Forward *rfwd = (struct Forward *)ctxt;
+ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
+ struct Forward *rfwd;
u_int port;
int r;
+ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
+ fatal_f("invalid forwarding ID %d", rctx->fid);
+ rfwd = &options.remote_forwards[rctx->fid];
+ freezero(rctx, sizeof(*rctx));
+
/* XXX verbose() on failure? */
debug("remote forward %s for: listen %s%s%d, connect %s:%d",
type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
@@ -2047,6 +2057,8 @@
/* Initiate remote TCP/IP port forwardings. */
for (i = 0; i < options.num_remote_forwards; i++) {
+ struct rfwd_confirm_ctx *rctx;
+
debug("Remote connections from %.200s:%d forwarded to "
"local address %.200s:%d",
(options.remote_forwards[i].listen_path != NULL) ?
@@ -2061,9 +2073,10 @@
if ((options.remote_forwards[i].handle =
channel_request_remote_forwarding(ssh,
&options.remote_forwards[i])) >= 0) {
+ rctx = xcalloc(1, sizeof(*rctx));
+ rctx->fid = i;
client_register_global_confirm(
- ssh_confirm_remote_forward,
- &options.remote_forwards[i]);
+ ssh_confirm_remote_forward, rctx);
forward_confirms_pending++;
} else if (options.exit_on_forward_failure)
fatal("Could not request remote forwarding.");

6
openssh.spec
View File

@ -268,6 +268,8 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch
Patch1049: openssh-10.4p1-CVE-2026-59999.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1050: openssh-10.5p1-CVE-2026-73281.patch
# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
Patch1051: openssh-10.5p1-CVE-2026-73282.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -482,6 +484,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1048 -p1 -b .CVE-2026-59995
%patch -P 1049 -p1 -b .CVE-2026-59999
%patch -P 1050 -p1 -b .CVE-2026-73281
%patch -P 1051 -p1 -b .CVE-2026-73282
%patch -P 100 -p1 -b .coverity
@ -769,6 +772,9 @@ test -f %{sysconfig_anaconda} && \
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245421
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-245417
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded