From aeac20e69c9bf1f9289f3c1c695666b1ae497317 Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Tue, 14 Apr 2026 10:45:18 +0200
Subject: [PATCH] Fix CVE-2026-35414

Fix mishandling of authorized_keys principals option

Resolves: RHEL-166203

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
 ...p1-authorized-keys-principles-option.patch | 45 +++++++++++++++++++
 openssh.spec                                  |  5 +++
 2 files changed, 50 insertions(+)
 create mode 100644 openssh-9.9p1-authorized-keys-principles-option.patch

diff --git a/openssh-9.9p1-authorized-keys-principles-option.patch b/openssh-9.9p1-authorized-keys-principles-option.patch
new file mode 100644
index 0000000..9bdd199
--- /dev/null
+++ b/openssh-9.9p1-authorized-keys-principles-option.patch
@@ -0,0 +1,45 @@
+diff --color -ruNp a/auth2-pubkeyfile.c b/auth2-pubkeyfile.c
+--- a/auth2-pubkeyfile.c	2024-09-20 00:20:48.000000000 +0200
++++ b/auth2-pubkeyfile.c	2026-04-09 14:38:41.697178612 +0200
+@@ -50,6 +50,7 @@
+ #include "authfile.h"
+ #include "match.h"
+ #include "ssherr.h"
++#include "xmalloc.h"
+ 
+ int
+ auth_authorise_keyopts(struct passwd *pw, struct sshauthopt *opts,
+@@ -146,20 +147,23 @@ auth_authorise_keyopts(struct passwd *pw
+ static int
+ match_principals_option(const char *principal_list, struct sshkey_cert *cert)
+ {
+-	char *result;
++	char *list, *olist, *entry;
+ 	u_int i;
+ 
+-	/* XXX percent_expand() sequences for authorized_principals? */
+-
+-	for (i = 0; i < cert->nprincipals; i++) {
+-		if ((result = match_list(cert->principals[i],
+-		    principal_list, NULL)) != NULL) {
+-			debug3("matched principal from key options \"%.100s\"",
+-			    result);
+-			free(result);
+-			return 1;
++	olist = list = xstrdup(principal_list);
++	for (;;) {
++		if ((entry = strsep(&list, ",")) == NULL || *entry == '\0')
++			break;
++		for (i = 0; i < cert->nprincipals; i++) {
++			if (strcmp(entry, cert->principals[i]) == 0) {
++				debug3("matched principal from key i"
++				    "options \"%.100s\"", entry);
++				free(olist);
++				return 1;
++			}
+ 		}
+ 	}
++	free(olist);
+ 	return 0;
+ }
+ 
diff --git a/openssh.spec b/openssh.spec
index 34b97b1..d3fb30f 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -255,6 +255,8 @@ Patch1041: openssh-9.9p1-scp-clear-setuid.patch
 Patch1042: openssh-9.9p1-mux-askpass-check.patch
 # upstream fd1c7e131f331942d20f42f31e79912d570081fa
 Patch1043: openssh-9.9p1-ecdsa-incomplete-application.patch
+# upstream fd1c7e131f331942d20f42f31e79912d570081fa
+Patch1044: openssh-9.9p1-authorized-keys-principles-option.patch
 
 License: BSD
 Requires: /sbin/nologin
@@ -472,6 +474,7 @@ popd
 %patch1041 -p1 -b .scp-clear-setuid
 %patch1042 -p1 -b .mux-askpass-check
 %patch1043 -p1 -b .ecdsa-incomplete-application
+%patch1044 -p1 -b .authorized-keys-principles-option
 
 %patch100 -p1 -b .coverity
 
@@ -776,6 +779,8 @@ test -f %{sysconfig_anaconda} && \
 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
   and HostbasedAcceptedAlgorithms with regard to ECDSA keys
   Resolves: RHEL-166235
+- CVE-2026-35414: Fix mishandling of authorized_keys principals option
+  Resolves: RHEL-166203
 
 * Thu Mar 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7 + 0.10.4-9
 - Version bump