rpms/openssh
6
0
Fork 2
Code Issues Pull Requests Releases Activity

CVE-2025-61984: Reject usernames with control characters

Browse Source 
Resolves: RHEL-133959

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2025-12-09 14:55:15 +01:00
parent 089b1c70fd
commit b31035999d
2 changed files with 64 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
openssh-9.9p1-reject-cntrl-chars-in-username.patch Normal file
View File

@ -0,0 +1,59 @@
diff --color -ruNp a/ssh.c b/ssh.c
--- a/ssh.c 2025-12-03 15:22:36.754555231 +0100
+++ b/ssh.c 2025-12-03 16:12:16.715320349 +0100
@@ -662,6 +662,8 @@ valid_ruser(const char *s)
if (*s == '-')
return 0;
for (i = 0; s[i] != 0; i++) {
+ if (iscntrl((u_char)s[i]))
+ return 0;
if (strchr("'`\";&<>|(){}", s[i]) != NULL)
return 0;
/* Disallow '-' after whitespace */
@@ -683,6 +685,7 @@ main(int ac, char **av)
struct ssh *ssh = NULL;
int i, r, opt, exit_status, use_syslog, direct, timeout_ms;
int was_addr, config_test = 0, opt_terminated = 0, want_final_pass = 0;
+ int user_on_commandline = 0;
char *p, *cp, *line, *argv0, *logfile;
char cname[NI_MAXHOST], thishost[NI_MAXHOST];
struct stat st;
@@ -1039,8 +1042,10 @@ main(int ac, char **av)
}
break;
case 'l':
- if (options.user == NULL)
+ if (options.user == NULL) {
options.user = optarg;
+ user_on_commandline = 1;
+ }
break;
case 'L':
@@ -1143,6 +1148,7 @@ main(int ac, char **av)
if (options.user == NULL) {
options.user = tuser;
tuser = NULL;
+ user_on_commandline = 1;
}
free(tuser);
if (options.port == -1 && tport != -1)
@@ -1157,6 +1163,7 @@ main(int ac, char **av)
if (options.user == NULL) {
options.user = p;
p = NULL;
+ user_on_commandline = 1;
}
*cp++ = '\0';
host = xstrdup(cp);
@@ -1459,6 +1466,10 @@ main(int ac, char **av)
cinfo->locuser = xstrdup(pw->pw_name);
cinfo->jmphost = xstrdup(options.jump_host == NULL ?
"" : options.jump_host);
+
+ if (user_on_commandline && !valid_ruser(options.user))
+ fatal("remote username contains invalid characters");
+
cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost,
cinfo->remhost, cinfo->portstr, cinfo->remuser, cinfo->jmphost);

5
openssh.spec
View File

@ -240,6 +240,8 @@ Patch1034: openssh-9.9p1-fips-gss.patch
#upstream 4f14ca8633a2c8c0a1a19165663421f0ab32f6ab
Patch1035: openssh-9.9p1-scp-traversing.patch
Patch1036: openssh-9.9p1-canonical-match-user.patch
# upstream 35d5917652106aede47621bb3f64044604164043
Patch1037: openssh-9.9p1-reject-cntrl-chars-in-username.patch
License: BSD
Requires: /sbin/nologin
@ -452,6 +454,7 @@ popd
%patch1034 -p1 -b .gss-fips
%patch1035 -p1 -b .scp-traversing
%patch1036 -p1 -b .canonical-match-user
%patch1037 -p1 -b .reject-cntrl-chars-in-username
autoreconf
pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@ -743,6 +746,8 @@ test -f %{sysconfig_anaconda} && \
* Tue Dec 09 2025 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
- Enable support for DSA keys
Resolves: RHEL-127624
- CVE-2025-61984: Reject usernames with control characters
Resolves: RHEL-133959
* Mon Oct 27 2025 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
- Fix implicit destination path selection when source path ends with ".."