From 9b511fc6104b479821e4c7b3a6ab60002d2ca2ac Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 25 Jun 2026 16:58:51 +0200 Subject: [PATCH] Fix CVE-2026-55655 Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185848 Signed-off-by: Zoltan Fridrich --- openssh-7.2p2-x11.patch | 11 ++++++----- openssh.spec | 3 +++ 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/openssh-7.2p2-x11.patch b/openssh-7.2p2-x11.patch index 6db16be..a605a41 100644 --- a/openssh-7.2p2-x11.patch +++ b/openssh-7.2p2-x11.patch @@ -32,7 +32,7 @@ diff --git a/channels.c b/channels.c return -1; } -@@ -5099,8 +5102,18 @@ +@@ -5099,8 +5102,19 @@ connect_local_xsocket(u_int dnr) { char buf[1024]; @@ -41,10 +41,11 @@ diff --git a/channels.c b/channels.c + int len, ret; + len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr); +#ifdef linux -+ /* try abstract socket first */ -+ buf[0] = '\0'; -+ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0) -+ return ret; ++ if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) { ++ buf[0] = '\0'; ++ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0) ++ return ret; ++ } +#endif + if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0) + return ret; diff --git a/openssh.spec b/openssh.spec index 3dc41bd..2498505 100644 --- a/openssh.spec +++ b/openssh.spec @@ -747,6 +747,9 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185831 +- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket + pre-binding + Resolves: RHEL-185848 * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication