rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-59995: sftp download to server-controlled path

Browse Source 
Backport fix for CVE-2026-59995 to openssh-8.0p1. The upstream
commit fixes a vulnerability in sftp where a download on the
commandline could be directed to a server-controlled path. The
fix replaces the vulnerable code pattern (which built a command
string via snprintf and parsed it with parse_dispatch_command)
with a direct call to process_get(), bypassing the command
parsing entirely. Added as Patch1030.

CVE: CVE-2026-59995
Upstream patches:
 - 1b39f39657.patch
Resolves: RHEL-236324

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-12 11:18:55 +00:00 committed by Dmitry Belyavskiy
parent f5884ebcc6
commit 9faed41614
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
openssh-8.0p1-CVE-2026-59995.patch Normal file
View File

@ -0,0 +1,33 @@
From 3860783959126ee4c01fabb0ae11522b1df86efb Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Mon, 29 Jun 2026 01:47:21 +0000
Subject: [PATCH] upstream: avoid download to server-controlled path when
performing
download on the commandline. From Swival scanner
OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
---
sftp.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/sftp.c b/sftp.c
index be901f5..8b7b799 100644
--- a/sftp.c
+++ b/sftp.c
@@ -2226,13 +2226,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
return (-1);
}
} else {
- /* XXX this is wrong wrt quoting */
- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
- global_aflag ? " -a" : "", dir,
- file2 == NULL ? "" : " ",
- file2 == NULL ? "" : file2);
- err = parse_dispatch_command(conn, cmd,
- &remote_path, startdir, 1, 0);
+ err = process_get(conn, dir, file2, remote_path, 0, 0,
+ global_aflag, 0);
free(dir);
free(startdir);
free(remote_path);

10
openssh.spec
View File

@ -66,7 +66,7 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 8.0p1
%global openssh_rel 30
%global openssh_rel 31
%global pam_ssh_agent_ver 0.10.3
%global pam_ssh_agent_rel 7
@ -313,6 +313,8 @@ Patch1028: openssh-8.7p1-authorized-keys-principles-option.patch
# upstream 607bd871ec029e9aa22e632a22547250f3cae223
# upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch
# upstream 1b39f39657d2e58f8ec57341581a39bbf0be645b
Patch1030: openssh-8.0p1-CVE-2026-59995.patch
License: BSD
Group: Applications/Internet
@ -569,6 +571,7 @@ popd
%patch1027 -p1 -b .ecdsa-incomplete-application
%patch1028 -p1 -b .authorized-keys-principles-option
%patch1029 -p1 -b .proxyjump-username-validity-checks
%patch1030 -p1 -b .cve-2026-59995
autoreconf
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@ -854,6 +857,11 @@ getent passwd sshd >/dev/null || \
%endif
%changelog
* Wed Aug 12 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 8.0p1-31
- CVE-2026-59995: Fix sftp download to server-controlled path when
performing download on the commandline
Resolves: RHEL-236324
* Mon Jun 29 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-30
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
FIPS known-group validation that leads to client-side denial of service