From 74e87d59a4010d55aa14b929c7ce1d28e884aba8 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Fri, 21 Aug 2026 13:03:04 +0200 Subject: [PATCH] Fix CVE-2026-73282 Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245417 Signed-off-by: Zoltan Fridrich --- openssh-10.5p1-CVE-2026-73282.patch | 51 +++++++++++++++++++++++++++++ openssh.spec | 6 ++++ 2 files changed, 57 insertions(+) create mode 100644 openssh-10.5p1-CVE-2026-73282.patch diff --git a/openssh-10.5p1-CVE-2026-73282.patch b/openssh-10.5p1-CVE-2026-73282.patch new file mode 100644 index 0000000..a4c4973 --- /dev/null +++ b/openssh-10.5p1-CVE-2026-73282.patch @@ -0,0 +1,51 @@ +diff --git a/ssh.c b/ssh.c +--- a/ssh.c ++++ b/ssh.c +@@ -1862,14 +1862,24 @@ + } + } + ++struct rfwd_confirm_ctx { ++ int fid; ++}; ++ + /* Callback for remote forward global requests */ + static void + ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) + { +- struct Forward *rfwd = (struct Forward *)ctxt; ++ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt; ++ struct Forward *rfwd; + u_int port; + int r; + ++ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards) ++ fatal_f("invalid forwarding ID %d", rctx->fid); ++ rfwd = &options.remote_forwards[rctx->fid]; ++ freezero(rctx, sizeof(*rctx)); ++ + /* XXX verbose() on failure? */ + debug("remote forward %s for: listen %s%s%d, connect %s:%d", + type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", +@@ -2047,6 +2057,8 @@ + + /* Initiate remote TCP/IP port forwardings. */ + for (i = 0; i < options.num_remote_forwards; i++) { ++ struct rfwd_confirm_ctx *rctx; ++ + debug("Remote connections from %.200s:%d forwarded to " + "local address %.200s:%d", + (options.remote_forwards[i].listen_path != NULL) ? +@@ -2061,9 +2073,10 @@ + if ((options.remote_forwards[i].handle = + channel_request_remote_forwarding(ssh, + &options.remote_forwards[i])) >= 0) { ++ rctx = xcalloc(1, sizeof(*rctx)); ++ rctx->fid = i; + client_register_global_confirm( +- ssh_confirm_remote_forward, +- &options.remote_forwards[i]); ++ ssh_confirm_remote_forward, rctx); + forward_confirms_pending++; + } else if (options.exit_on_forward_failure) + fatal("Could not request remote forwarding."); diff --git a/openssh.spec b/openssh.spec index 08fe7ee..7a6f1bf 100644 --- a/openssh.spec +++ b/openssh.spec @@ -268,6 +268,8 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch Patch1049: openssh-10.4p1-CVE-2026-59999.patch # upstream 6a57081dc35acf3ee298108d4bc3580489608d5f Patch1050: openssh-10.5p1-CVE-2026-73281.patch +# upstream 9910d5ef53124ce1157d57bc11e222658aa41299 +Patch1051: openssh-10.5p1-CVE-2026-73282.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -482,6 +484,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1048 -p1 -b .CVE-2026-59995 %patch -P 1049 -p1 -b .CVE-2026-59999 %patch -P 1050 -p1 -b .CVE-2026-73281 +%patch -P 1051 -p1 -b .CVE-2026-73282 %patch -P 100 -p1 -b .coverity @@ -769,6 +772,9 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245421 +- CVE-2026-73282: Fix information disclosure and data corruption + via use-after-free in ssh client + Resolves: RHEL-245417 * Wed Aug 12 2026 Dmitry Belyavskiy - 9.9p1-29 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded