rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded

Browse Source 
...file location

Resolves: RHEL-236323
This commit is contained in:
Dmitry Belyavskiy 2026-08-12 13:26:08 +02:00
parent 274a6bf6ad
commit ab99bff6e8
2 changed files with 29 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
openssh-10.4p1-CVE-2026-59995.patch Normal file
View File

@ -0,0 +1,20 @@
diff --git a/sftp.c b/sftp.c
index 0ab9206c2..0b57e0833 100644
--- a/sftp.c
+++ b/sftp.c
@@ -2289,13 +2289,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
return (-1);
}
} else {
- /* XXX this is wrong wrt quoting */
- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
- global_aflag ? " -a" : "", dir,
- file2 == NULL ? "" : " ",
- file2 == NULL ? "" : file2);
- err = parse_dispatch_command(conn, cmd,
- &remote_path, startdir, 1, 0);
+ err = process_get(conn, dir, file2, remote_path, 0, 0,
+ global_aflag, 0);
free(dir);
free(startdir);
free(remote_path);

10
openssh.spec
View File

@ -43,7 +43,7 @@
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
Release: 28%{?dist}
Release: 29%{?dist}
URL: http://www.openssh.com/portable.html
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@ -259,6 +259,8 @@ Patch1046: openssh-9.9p1-cve-2026-60002.patch
# upstream 8b05bbeb293c5f777915e37e9ed43a06fb8e7614
# upstream 5a5e47740b6466d58242aca28b9e584bab4ccf1d
Patch1047: openssh-9.9p1-copy-data-ext-self-copy.patch
# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
Patch1048: openssh-10.4p1-CVE-2026-59995.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
Requires: /sbin/nologin
@ -470,6 +472,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
%patch -P 1045 -p1 -b .scp-remote-glob
%patch -P 1046 -p1 -b .cve-2026-60002
%patch -P 1047 -p1 -b .copy-data-ext-self-copy
%patch -P 1048 -p1 -b .CVE-2026-59995
%patch -P 100 -p1 -b .coverity
@ -750,6 +753,11 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location
Resolves: RHEL-236323
* Thu Jul 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-28
- Fix GSSAPI indicators check ignoring subsequent deny rules if
allow rule matched first