From 9faed41614513385a186200aa8e495e1fdcd3916 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 12 Aug 2026 11:18:55 +0000 Subject: [PATCH] Fix CVE-2026-59995: sftp download to server-controlled path Backport fix for CVE-2026-59995 to openssh-8.0p1. The upstream commit fixes a vulnerability in sftp where a download on the commandline could be directed to a server-controlled path. The fix replaces the vulnerable code pattern (which built a command string via snprintf and parsed it with parse_dispatch_command) with a direct call to process_get(), bypassing the command parsing entirely. Added as Patch1030. CVE: CVE-2026-59995 Upstream patches: - https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b.patch Resolves: RHEL-236324 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- openssh-8.0p1-CVE-2026-59995.patch | 33 ++++++++++++++++++++++++++++++ openssh.spec | 10 ++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 openssh-8.0p1-CVE-2026-59995.patch diff --git a/openssh-8.0p1-CVE-2026-59995.patch b/openssh-8.0p1-CVE-2026-59995.patch new file mode 100644 index 0000000..d7d02d9 --- /dev/null +++ b/openssh-8.0p1-CVE-2026-59995.patch @@ -0,0 +1,33 @@ +From 3860783959126ee4c01fabb0ae11522b1df86efb Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 29 Jun 2026 01:47:21 +0000 +Subject: [PATCH] upstream: avoid download to server-controlled path when + performing + +download on the commandline. From Swival scanner + +OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f +--- + sftp.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/sftp.c b/sftp.c +index be901f5..8b7b799 100644 +--- a/sftp.c ++++ b/sftp.c +@@ -2226,13 +2226,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2) + return (-1); + } + } else { +- /* XXX this is wrong wrt quoting */ +- snprintf(cmd, sizeof cmd, "get%s %s%s%s", +- global_aflag ? " -a" : "", dir, +- file2 == NULL ? "" : " ", +- file2 == NULL ? "" : file2); +- err = parse_dispatch_command(conn, cmd, +- &remote_path, startdir, 1, 0); ++ err = process_get(conn, dir, file2, remote_path, 0, 0, ++ global_aflag, 0); + free(dir); + free(startdir); + free(remote_path); diff --git a/openssh.spec b/openssh.spec index 2b7a678..725b23f 100644 --- a/openssh.spec +++ b/openssh.spec @@ -66,7 +66,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.0p1 -%global openssh_rel 30 +%global openssh_rel 31 %global pam_ssh_agent_ver 0.10.3 %global pam_ssh_agent_rel 7 @@ -313,6 +313,8 @@ Patch1028: openssh-8.7p1-authorized-keys-principles-option.patch # upstream 607bd871ec029e9aa22e632a22547250f3cae223 # upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch +# upstream 1b39f39657d2e58f8ec57341581a39bbf0be645b +Patch1030: openssh-8.0p1-CVE-2026-59995.patch License: BSD Group: Applications/Internet @@ -569,6 +571,7 @@ popd %patch1027 -p1 -b .ecdsa-incomplete-application %patch1028 -p1 -b .authorized-keys-principles-option %patch1029 -p1 -b .proxyjump-username-validity-checks +%patch1030 -p1 -b .cve-2026-59995 autoreconf pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver} @@ -854,6 +857,11 @@ getent passwd sshd >/dev/null || \ %endif %changelog +* Wed Aug 12 2026 RHEL Packaging Agent - 8.0p1-31 +- CVE-2026-59995: Fix sftp download to server-controlled path when + performing download on the commandline + Resolves: RHEL-236324 + * Mon Jun 29 2026 Zoltan Fridrich - 8.0p1-30 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service