rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-35414

Browse Source 
Fix mishandling of authorized_keys principals option

Resolves: RHEL-166191

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-04-10 13:19:44 +02:00
parent 418d6a85be
commit 88128fdefa
2 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
openssh-9.9p1-authorized-keys-principles-option.patch Normal file
View File

@ -0,0 +1,45 @@
diff --color -ruNp a/auth2-pubkeyfile.c b/auth2-pubkeyfile.c
--- a/auth2-pubkeyfile.c 2024-09-20 00:20:48.000000000 +0200
+++ b/auth2-pubkeyfile.c 2026-04-09 14:38:41.697178612 +0200
@@ -50,6 +50,7 @@
#include "authfile.h"
#include "match.h"
#include "ssherr.h"
+#include "xmalloc.h"
int
auth_authorise_keyopts(struct passwd *pw, struct sshauthopt *opts,
@@ -146,20 +147,23 @@ auth_authorise_keyopts(struct passwd *pw
static int
match_principals_option(const char *principal_list, struct sshkey_cert *cert)
{
- char *result;
+ char *list, *olist, *entry;
u_int i;
- /* XXX percent_expand() sequences for authorized_principals? */
-
- for (i = 0; i < cert->nprincipals; i++) {
- if ((result = match_list(cert->principals[i],
- principal_list, NULL)) != NULL) {
- debug3("matched principal from key options \"%.100s\"",
- result);
- free(result);
- return 1;
+ olist = list = xstrdup(principal_list);
+ for (;;) {
+ if ((entry = strsep(&list, ",")) == NULL || *entry == '\0')
+ break;
+ for (i = 0; i < cert->nprincipals; i++) {
+ if (strcmp(entry, cert->principals[i]) == 0) {
+ debug3("matched principal from key i"
+ "options \"%.100s\"", entry);
+ free(olist);
+ return 1;
+ }
}
}
+ free(olist);
return 0;
}

5
openssh.spec
View File

@ -245,6 +245,8 @@ Patch1040: openssh-9.9p1-scp-clear-setuid.patch
Patch1041: openssh-9.9p1-mux-askpass-check.patch
# upstream fd1c7e131f331942d20f42f31e79912d570081fa
Patch1042: openssh-9.9p1-ecdsa-incomplete-application.patch
# upstream fd1c7e131f331942d20f42f31e79912d570081fa
Patch1043: openssh-9.9p1-authorized-keys-principles-option.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -451,6 +453,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1040 -p1 -b .scp-clear-setuid
%patch -P 1041 -p1 -b .mux-askpass-check
%patch -P 1042 -p1 -b .ecdsa-incomplete-application
%patch -P 1043 -p1 -b .authorized-keys-principles-option
%patch -P 100 -p1 -b .coverity
@ -745,6 +748,8 @@ test -f %{sysconfig_anaconda} && \
- CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
and HostbasedAcceptedAlgorithms with regard to ECDSA keys
Resolves: RHEL-166223
- CVE-2026-35414: Fix mishandling of authorized_keys principals option
Resolves: RHEL-166191
* Fri Mar 27 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-24
- Fix typo in SPDX license name