rpms/openssh
6
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix missing invalid error code checks in OpenSSH.

Browse Source 
It prevents a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465)
Resolves: RHEL-109228

Signed-off-by: Antonio Vieiro <avieirov@redhat.com>
This commit is contained in:
Antonio Vieiro 2025-08-20 10:12:37 +02:00
parent a61128003b
commit ae81dd6ae0
2 changed files with 66 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
openssh-8.0p1-CVE-2025-26465.patch Normal file
View File

@ -0,0 +1,57 @@
diff --git a/openssh-8.0p1/krl.c b/openssh-8.0p1/krl.c
index 8e2d5d5..e5b046d 100644
--- a/openssh-8.0p1/krl.c
+++ b/openssh-8.0p1/krl.c
@@ -676,6 +676,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
break;
case KRL_SECTION_CERT_SERIAL_BITMAP:
if (rs->lo - bitmap_start > INT_MAX) {
+ r = SSH_ERR_INVALID_FORMAT;
error("%s: insane bitmap gap", __func__);
goto out;
}
@@ -1011,6 +1012,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
goto out;
if ((krl = ssh_krl_init()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
error("%s: alloc failed", __func__);
goto out;
}
diff --git a/openssh-8.0p1/sshconnect2.c b/openssh-8.0p1/sshconnect2.c
index ce855eb..9650b24 100644
--- a/openssh-8.0p1/sshconnect2.c
+++ b/openssh-8.0p1/sshconnect2.c
@@ -95,7 +95,7 @@ struct sockaddr *xxx_hostaddr;
static int
verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
{
- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
+ if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) != 0)
fatal("Host key verification failed.");
return 0;
}
@@ -767,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
debug("%s: server sent unknown pkalg %s", __func__, pkalg);
+ r = SSH_ERR_INVALID_FORMAT;
goto done;
}
if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
@@ -777,6 +778,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
error("input_userauth_pk_ok: type mismatch "
"for decoded key (received %d, expected %d)",
key->type, pktype);
+ r = SSH_ERR_INVALID_FORMAT;
goto done;
}
@@ -796,6 +798,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
SSH_FP_DEFAULT);
error("%s: server replied with unknown key: %s %s", __func__,
sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
+ r = SSH_ERR_INVALID_FORMAT;
goto done;
}
ident = format_identity(id);

10
openssh.spec
View File

@ -66,7 +66,7 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 8.0p1
%global openssh_rel 25
%global openssh_rel 26
%global pam_ssh_agent_ver 0.10.3
%global pam_ssh_agent_rel 7
@ -294,6 +294,8 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch
Patch1020: openssh-8.7p1-scp-kill-switch.patch
#upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
Patch1021: openssh-8.0p1-upstream-ignore-SIGPIPE.patch
#upstream commit 0832aac79517611dd4de93ad0a83577994d9c907
Patch1022: openssh-8.0p1-CVE-2025-26465.patch
License: BSD
Group: Applications/Internet
@ -542,6 +544,7 @@ popd
%patch1019 -p1 -b .cve-2023-51385
%patch1020 -p1 -b .scp-kill-switch
%patch1021 -p1 -b .ignore-SIGPIPE
%patch1022 -p2 -b .cve-2025-26465
autoreconf
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@ -827,6 +830,11 @@ getent passwd sshd >/dev/null || \
%endif
%changelog
* Wed Aug 20 2025 Antonio Vieiro <avieirov@redhat.com> - 8.0p1-26
- Fix missing invalid error code checks in OpenSSH. It prevents
a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465)
Resolves: RHEL-109228
* Tue Jun 25 2024 Stepan Broz <sbroz@redhat.com> - 8.0p1-25
- Upstream: Ignore SIGPIPE earlier in main()
Resolves: RHEL-37743