rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Unpatch Red Hat help message

Browse Source
This commit is contained in:
Koichiro Iwao 2026-08-25 03:05:29 +00:00 committed by root
commit a6b5bb0cdf
4 changed files with 179 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
openssh-10.4p1-CVE-2026-59999.patch
View File

@ -1,5 +1,69 @@
diff --git a/auth-options.c b/auth-options.c
index e15f600ab..c5fc4e59c 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void)
ret->permit_x11_forwarding_flag = 1;
ret->permit_pty_flag = 1;
ret->permit_user_rc = 1;
+ ret->permit_tun_flag = 1;
return ret;
}
@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
ret->permit_x11_forwarding_flag = 0;
ret->permit_pty_flag = 0;
ret->permit_user_rc = 0;
+ ret->permit_tun_flag = 0;
} else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
ret->cert_authority = r;
} else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
OPTFLAG_AND(permit_x11_forwarding_flag);
OPTFLAG_AND(permit_pty_flag);
OPTFLAG_AND(permit_user_rc);
+ OPTFLAG_AND(permit_tun_flag);
OPTFLAG_AND(no_require_user_presence);
/* Restrictive flags are logical-OR (i.e. must be set in either) */
OPTFLAG_OR(require_verify);
@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig)
OPTSCALAR(permit_x11_forwarding_flag);
OPTSCALAR(permit_pty_flag);
OPTSCALAR(permit_user_rc);
+ OPTSCALAR(permit_tun_flag);
OPTSCALAR(restricted);
OPTSCALAR(cert_authority);
OPTSCALAR(force_tun_device);
@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
(r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
(r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
(r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
OPT_FLAG(permit_x11_forwarding_flag);
OPT_FLAG(permit_pty_flag);
OPT_FLAG(permit_user_rc);
+ OPT_FLAG(permit_tun_flag);
OPT_FLAG(restricted);
OPT_FLAG(cert_authority);
OPT_FLAG(no_require_user_presence);
diff --git a/auth-options.h b/auth-options.h
index 6e29b727c..191b9b249 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -39,6 +39,7 @@ struct sshauthopt {
int permit_x11_forwarding_flag;
int permit_pty_flag;
int permit_user_rc;
+ int permit_tun_flag;
/* "restrict" keyword was invoked */
int restricted;
diff --git a/serverloop.c b/serverloop.c
index 8a6e3db80..9d8a3429e 100644
index 8a6e3db80..cf5243f80 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
@ -8,7 +72,7 @@ index 8a6e3db80..9d8a3429e 100644
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+ auth_opts->restricted) {
+ !auth_opts->permit_tun_flag) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;

42
openssh-10.5p1-CVE-2026-73281.patch Normal file
View File

@ -0,0 +1,42 @@
diff --git a/ssh-agent.c b/ssh-agent.c
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e)
error_fr(r, "parse");
goto send;
}
+
+ /*
+ * This function can be called while the agent is locked to allow
+ * session binds to be processed for new channels.
+ * Other operations should be refused when locked.
+ */
+
if (strcmp(name, "session-bind@openssh.com") == 0)
success = process_ext_session_bind(e);
+ else if (locked)
+ debug_f("attempt to use extension \"%s\" while locked", name);
else
debug_f("unsupported extension \"%s\"", name);
free(name);
@@ -1892,16 +1901,19 @@ process_message(u_int socknum)
/* check whether agent is locked */
if (locked && type != SSH_AGENTC_UNLOCK) {
- sshbuf_reset(e->request);
switch (type) {
case SSH2_AGENTC_REQUEST_IDENTITIES:
/* send empty lists */
no_identities(e);
break;
+ case SSH_AGENTC_EXTENSION:
+ process_extension(e);
+ break;
default:
/* send a fail message for all other request types */
send_status(e, 0);
}
+ sshbuf_reset(e->request);
return 1;
}

51
openssh-10.5p1-CVE-2026-73282.patch Normal file
View File

@ -0,0 +1,51 @@
diff --git a/ssh.c b/ssh.c
--- a/ssh.c
+++ b/ssh.c
@@ -1862,14 +1862,24 @@
}
}
+struct rfwd_confirm_ctx {
+ int fid;
+};
+
/* Callback for remote forward global requests */
static void
ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
{
- struct Forward *rfwd = (struct Forward *)ctxt;
+ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
+ struct Forward *rfwd;
u_int port;
int r;
+ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
+ fatal_f("invalid forwarding ID %d", rctx->fid);
+ rfwd = &options.remote_forwards[rctx->fid];
+ freezero(rctx, sizeof(*rctx));
+
/* XXX verbose() on failure? */
debug("remote forward %s for: listen %s%s%d, connect %s:%d",
type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
@@ -2047,6 +2057,8 @@
/* Initiate remote TCP/IP port forwardings. */
for (i = 0; i < options.num_remote_forwards; i++) {
+ struct rfwd_confirm_ctx *rctx;
+
debug("Remote connections from %.200s:%d forwarded to "
"local address %.200s:%d",
(options.remote_forwards[i].listen_path != NULL) ?
@@ -2061,9 +2073,10 @@
if ((options.remote_forwards[i].handle =
channel_request_remote_forwarding(ssh,
&options.remote_forwards[i])) >= 0) {
+ rctx = xcalloc(1, sizeof(*rctx));
+ rctx->fid = i;
client_register_global_confirm(
- ssh_confirm_remote_forward,
- &options.remote_forwards[i]);
+ ssh_confirm_remote_forward, rctx);
forward_confirms_pending++;
} else if (options.exit_on_forward_failure)
fatal("Could not request remote forwarding.");

22
openssh.spec
View File

@ -43,7 +43,7 @@
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
Release: 29%{?dist}.alma.1
Release: 30%{?dist}.alma.1
URL: http://www.openssh.com/portable.html
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@ -264,7 +264,12 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
# combines CVE-2026-59999 and CVE-2026-73283
# downstream specific fix, drop on rebase
Patch1049: openssh-10.4p1-CVE-2026-59999.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1050: openssh-10.5p1-CVE-2026-73281.patch
# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
Patch1051: openssh-10.5p1-CVE-2026-73282.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -478,6 +483,8 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1047 -p1 -b .copy-data-ext-self-copy
%patch -P 1048 -p1 -b .CVE-2026-59995
%patch -P 1049 -p1 -b .CVE-2026-59999
%patch -P 1050 -p1 -b .CVE-2026-73281
%patch -P 1051 -p1 -b .CVE-2026-73282
%patch -P 100 -p1 -b .coverity
@ -758,9 +765,20 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
* Fri Aug 14 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-29.alma.1
* Tue Aug 25 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-30.alma.1
- Unpatch Red Hat help message
* Fri Aug 21 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-30
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-242759
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245421
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-245417
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location