rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73281

Browse Source 
Fix misinteraction between agent locking and
the session-bind@openssh.com extension

Resolves: RHEL-245421

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-21 12:46:16 +02:00
parent d3793c1b8d
commit 8fe12bdb0f
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
openssh-10.5p1-CVE-2026-73281.patch Normal file
View File

@ -0,0 +1,42 @@
diff --git a/ssh-agent.c b/ssh-agent.c
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e)
error_fr(r, "parse");
goto send;
}
+
+ /*
+ * This function can be called while the agent is locked to allow
+ * session binds to be processed for new channels.
+ * Other operations should be refused when locked.
+ */
+
if (strcmp(name, "session-bind@openssh.com") == 0)
success = process_ext_session_bind(e);
+ else if (locked)
+ debug_f("attempt to use extension \"%s\" while locked", name);
else
debug_f("unsupported extension \"%s\"", name);
free(name);
@@ -1892,16 +1901,19 @@ process_message(u_int socknum)
/* check whether agent is locked */
if (locked && type != SSH_AGENTC_UNLOCK) {
- sshbuf_reset(e->request);
switch (type) {
case SSH2_AGENTC_REQUEST_IDENTITIES:
/* send empty lists */
no_identities(e);
break;
+ case SSH_AGENTC_EXTENSION:
+ process_extension(e);
+ break;
default:
/* send a fail message for all other request types */
send_status(e, 0);
}
+ sshbuf_reset(e->request);
return 1;
}

6
openssh.spec
View File

@ -266,6 +266,8 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch
# combines CVE-2026-59999 and CVE-2026-73283
# downstream specific fix, drop on rebase
Patch1049: openssh-10.4p1-CVE-2026-59999.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1050: openssh-10.5p1-CVE-2026-73281.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -479,6 +481,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1047 -p1 -b .copy-data-ext-self-copy
%patch -P 1048 -p1 -b .CVE-2026-59995
%patch -P 1049 -p1 -b .CVE-2026-59999
%patch -P 1050 -p1 -b .CVE-2026-73281
%patch -P 100 -p1 -b .coverity
@ -763,6 +766,9 @@ test -f %{sysconfig_anaconda} && \
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-242759
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245421
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded