From 96e0821266e2abb32f33ba91fc1a6fa49107a95e Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 14 Jul 2026 11:52:47 +0200 Subject: [PATCH] Fix CVE-2026-59996 Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193172 Signed-off-by: Zoltan Fridrich --- openssh-9.9p1-scp-remote-glob.patch | 14 ++++++++++++++ openssh.spec | 7 +++++++ 2 files changed, 21 insertions(+) create mode 100644 openssh-9.9p1-scp-remote-glob.patch diff --git a/openssh-9.9p1-scp-remote-glob.patch b/openssh-9.9p1-scp-remote-glob.patch new file mode 100644 index 0000000..c08101e --- /dev/null +++ b/openssh-9.9p1-scp-remote-glob.patch @@ -0,0 +1,14 @@ +diff --color -ruNp a/scp.c b/scp.c +--- a/scp.c 2026-07-14 11:40:47.754600847 +0200 ++++ b/scp.c 2026-07-14 11:43:04.077524517 +0200 +@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from + goto out; + } + ++ /* Special handling for source of '..' */ ++ if (strcmp(filename, "..") == 0) ++ filename = "."; /* Download to dest, not dest/.. */ ++ + if (targetisdir) + abs_dst = sftp_path_append(target, filename); + else diff --git a/openssh.spec b/openssh.spec index 2498505..c1254a1 100644 --- a/openssh.spec +++ b/openssh.spec @@ -252,6 +252,8 @@ Patch1043: openssh-9.9p1-authorized-keys-principles-option.patch # upstream 607bd871ec029e9aa22e632a22547250f3cae223 # upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce Patch1044: openssh-9.9p1-proxyjump-username-validity-checks.patch +# upstream 36480181fa22f98e180b4f9e10203480c0346c78 +Patch1045: openssh-9.9p1-scp-remote-glob.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -460,6 +462,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1042 -p1 -b .ecdsa-incomplete-application %patch -P 1043 -p1 -b .authorized-keys-principles-option %patch -P 1044 -p1 -b .proxyjump-username-validity-checks +%patch -P 1045 -p1 -b .scp-remote-glob %patch -P 100 -p1 -b .coverity @@ -750,6 +753,10 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185848 +- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed + in unintended parent directories when scp performs remote-to-remote copy + via the local host + Resolves: RHEL-193172 * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication