From 5ff57950f59ccec4da1e4ae0352646a551e8cb77 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 25 Jun 2026 16:40:10 +0200 Subject: [PATCH 1/5] Fix CVE-2026-55653 Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-185776 Signed-off-by: Zoltan Fridrich --- openssh-7.7p1-fips.patch | 11 ++++++----- openssh.spec | 7 ++++++- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/openssh-7.7p1-fips.patch b/openssh-7.7p1-fips.patch index 8d442a4..bc44ef3 100644 --- a/openssh-7.7p1-fips.patch +++ b/openssh-7.7p1-fips.patch @@ -106,17 +106,18 @@ diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c #include #include -@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32 - r = SSH_ERR_ALLOC_FAIL; - goto out; +@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32 } + p = g = NULL; /* belong to kex->dh now */ + + if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) { + r = SSH_ERR_INVALID_ARGUMENT; + goto out; + } - p = g = NULL; /* belong to kex->dh now */ - ++ /* generate and send 'e', client DH public key */ + if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0) + goto out; diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h --- openssh-8.6p1/myproposal.h.fips 2021-04-16 05:55:25.000000000 +0200 +++ openssh-8.6p1/myproposal.h 2021-05-06 12:08:36.498926877 +0200 diff --git a/openssh.spec b/openssh.spec index cbb2de7..72699f6 100644 --- a/openssh.spec +++ b/openssh.spec @@ -43,7 +43,7 @@ Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: 26%{?dist} +Release: 27%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -740,6 +740,11 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Fri Jun 26 2026 Zoltan Fridrich - 9.9p1-27 +- CVE-2026-55653: Fix double free in openssh DH-GEX client path during + FIPS known-group validation that leads to client-side denial of service + Resolves: RHEL-185776 + * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication Related: RHEL-92932 From 4c42e8b4554c4f30eb7a5a44844f570602c8c248 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 25 Jun 2026 16:48:32 +0200 Subject: [PATCH 2/5] Fix CVE-2026-55654 Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185831 Signed-off-by: Zoltan Fridrich --- ...-authentication-indicators-in-GSSAPI.patch | 82 ++++++++++--------- openssh.spec | 3 + 2 files changed, 46 insertions(+), 39 deletions(-) diff --git a/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch b/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch index 6c55a66..2a74740 100644 --- a/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch +++ b/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch @@ -10,8 +10,8 @@ diff --color -ruNp a/configure.ac b/configure.ac AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1], [Define this if you want to use libkafs' AFS support])]) diff --color -ruNp a/gss-serv.c b/gss-serv.c ---- a/gss-serv.c 2026-03-10 12:43:36.802443034 +0100 -+++ b/gss-serv.c 2026-03-12 10:04:37.520993330 +0100 +--- a/gss-serv.c 2026-06-16 15:38:26.590728235 +0200 ++++ b/gss-serv.c 2026-06-16 15:41:13.717696103 +0200 @@ -53,7 +53,7 @@ extern ServerOptions options; static ssh_gssapi_client gssapi_client = @@ -21,7 +21,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c ssh_gssapi_mech gssapi_null_mech = { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL}; -@@ -295,6 +295,95 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss +@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss return GSS_S_COMPLETE; } @@ -44,63 +44,67 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c + int is_mechname, authenticated, complete, more; + size_t count, i; + ++ /* always initialize client->indicators */ ++ client->indicators = NULL; ++ + ctx->major = gss_inquire_name(&ctx->minor, gss_name, + &is_mechname, NULL, &attrs); -+ if (ctx->major != GSS_S_COMPLETE) { -+ return (ctx->major); -+ } ++ if (ctx->major != GSS_S_COMPLETE) ++ return ctx->major; + + if (attrs == GSS_C_NO_BUFFER_SET) { -+ /* No indicators in the ticket */ -+ return (0); ++ /* no indicators in the ticket */ ++ return GSS_S_COMPLETE; + } + -+ client->indicators = NULL; ++ /* client->indicators is NULL terminated */ + count = 0; ++ client->indicators = xcalloc(count + 1, sizeof(char *)); ++ + for (i = 0; i < attrs->count; i++) { + authenticated = 0; + complete = 0; + more = -1; ++ + /* skip anything but auth-indicators */ + if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) || -+ memcmp(AUTH_INDICATORS_TAG, -+ attrs->elements[i].value, ++ memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value, + sizeof(AUTH_INDICATORS_TAG) - 1) != 0) + continue; ++ + /* retrieve all indicators */ + while (more != 0) { + value.value = NULL; + display_value.value = NULL; ++ + ctx->major = gss_get_name_attribute(&ctx->minor, gss_name, -+ &attrs->elements[i], &authenticated, -+ &complete, &value, &display_value, &more); ++ &attrs->elements[i], ++ &authenticated, &complete, ++ &value, &display_value, &more); + if (ctx->major != GSS_S_COMPLETE) + goto out; + -+ if ((value.value != NULL) && authenticated) { -+ if (count >= SSH_GSSAPI_MAX_INDICATORS) { -+ logit("ssh_gssapi_getindicators: too many " -+ "indicators, truncating at %d", -+ SSH_GSSAPI_MAX_INDICATORS); -+ /* value/display_value released at out: */ -+ goto done; -+ } ++ if (value.value == NULL || !authenticated) ++ continue; + -+ client->indicators = xrecallocarray(client->indicators, count, count + 1, sizeof(char*)); -+ if (client->indicators == NULL) { -+ fatal("ssh_gssapi_getindicators failed to allocate memory"); -+ } -+ client->indicators[count] = xmalloc(value.length + 1); -+ memcpy(client->indicators[count], value.value, value.length); -+ client->indicators[count][value.length] = '\0'; -+ count++; ++ if (count >= SSH_GSSAPI_MAX_INDICATORS) { ++ logit("ssh_gssapi_getindicators:" ++ " too many indicators, truncating at %d", ++ SSH_GSSAPI_MAX_INDICATORS); ++ goto out; + } ++ ++ client->indicators[count] = xmalloc(value.length + 1); ++ memcpy(client->indicators[count], value.value, value.length); ++ client->indicators[count][value.length] = '\0'; ++ count++; ++ ++ /* add NULL terminator */ ++ client->indicators = xrecallocarray(client->indicators, count, ++ count + 1, sizeof(char *)); + } + } + -+done: -+ /* slot [count] is zeroed by recallocarray, serves as NULL sentinel */ -+ +out: + if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) { + for (i = 0; i < count; i++) @@ -108,16 +112,16 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c + free(client->indicators); + client->indicators = NULL; + } -+ (void) gss_release_buffer(&ctx->minor, &value); -+ (void) gss_release_buffer(&ctx->minor, &display_value); -+ (void) gss_release_buffer_set(&ctx->minor, &attrs); -+ return (ctx->major); ++ gss_release_buffer(&ctx->minor, &value); ++ gss_release_buffer(&ctx->minor, &display_value); ++ gss_release_buffer_set(&ctx->minor, &attrs); ++ return ctx->major; +} + /* Extract the client details from a given context. This can only reliably * be called once for a context */ -@@ -384,6 +473,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g +@@ -384,6 +477,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g } gss_release_buffer(&ctx->minor, &ename); @@ -130,7 +134,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c /* We can't copy this structure, so we just move the pointer to it */ client->creds = ctx->client_creds; -@@ -446,6 +541,7 @@ int +@@ -446,6 +545,7 @@ int ssh_gssapi_userok(char *user, struct passwd *pw, int kex) { OM_uint32 lmin; @@ -138,7 +142,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c (void) kex; /* used in privilege separation */ -@@ -464,8 +560,14 @@ ssh_gssapi_userok(char *user, struct pas +@@ -464,8 +564,14 @@ ssh_gssapi_userok(char *user, struct pas gss_release_buffer(&lmin, &gssapi_client.displayname); gss_release_buffer(&lmin, &gssapi_client.exportedname); gss_release_cred(&lmin, &gssapi_client.creds); diff --git a/openssh.spec b/openssh.spec index 72699f6..3dc41bd 100644 --- a/openssh.spec +++ b/openssh.spec @@ -744,6 +744,9 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-185776 +- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator + cleanup due to missing NULL terminator + Resolves: RHEL-185831 * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication From 9b511fc6104b479821e4c7b3a6ab60002d2ca2ac Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 25 Jun 2026 16:58:51 +0200 Subject: [PATCH 3/5] Fix CVE-2026-55655 Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185848 Signed-off-by: Zoltan Fridrich --- openssh-7.2p2-x11.patch | 11 ++++++----- openssh.spec | 3 +++ 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/openssh-7.2p2-x11.patch b/openssh-7.2p2-x11.patch index 6db16be..a605a41 100644 --- a/openssh-7.2p2-x11.patch +++ b/openssh-7.2p2-x11.patch @@ -32,7 +32,7 @@ diff --git a/channels.c b/channels.c return -1; } -@@ -5099,8 +5102,18 @@ +@@ -5099,8 +5102,19 @@ connect_local_xsocket(u_int dnr) { char buf[1024]; @@ -41,10 +41,11 @@ diff --git a/channels.c b/channels.c + int len, ret; + len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr); +#ifdef linux -+ /* try abstract socket first */ -+ buf[0] = '\0'; -+ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0) -+ return ret; ++ if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) { ++ buf[0] = '\0'; ++ if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0) ++ return ret; ++ } +#endif + if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0) + return ret; diff --git a/openssh.spec b/openssh.spec index 3dc41bd..2498505 100644 --- a/openssh.spec +++ b/openssh.spec @@ -747,6 +747,9 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185831 +- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket + pre-binding + Resolves: RHEL-185848 * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication From 96e0821266e2abb32f33ba91fc1a6fa49107a95e Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 14 Jul 2026 11:52:47 +0200 Subject: [PATCH 4/5] Fix CVE-2026-59996 Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193172 Signed-off-by: Zoltan Fridrich --- openssh-9.9p1-scp-remote-glob.patch | 14 ++++++++++++++ openssh.spec | 7 +++++++ 2 files changed, 21 insertions(+) create mode 100644 openssh-9.9p1-scp-remote-glob.patch diff --git a/openssh-9.9p1-scp-remote-glob.patch b/openssh-9.9p1-scp-remote-glob.patch new file mode 100644 index 0000000..c08101e --- /dev/null +++ b/openssh-9.9p1-scp-remote-glob.patch @@ -0,0 +1,14 @@ +diff --color -ruNp a/scp.c b/scp.c +--- a/scp.c 2026-07-14 11:40:47.754600847 +0200 ++++ b/scp.c 2026-07-14 11:43:04.077524517 +0200 +@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from + goto out; + } + ++ /* Special handling for source of '..' */ ++ if (strcmp(filename, "..") == 0) ++ filename = "."; /* Download to dest, not dest/.. */ ++ + if (targetisdir) + abs_dst = sftp_path_append(target, filename); + else diff --git a/openssh.spec b/openssh.spec index 2498505..c1254a1 100644 --- a/openssh.spec +++ b/openssh.spec @@ -252,6 +252,8 @@ Patch1043: openssh-9.9p1-authorized-keys-principles-option.patch # upstream 607bd871ec029e9aa22e632a22547250f3cae223 # upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce Patch1044: openssh-9.9p1-proxyjump-username-validity-checks.patch +# upstream 36480181fa22f98e180b4f9e10203480c0346c78 +Patch1045: openssh-9.9p1-scp-remote-glob.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -460,6 +462,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1042 -p1 -b .ecdsa-incomplete-application %patch -P 1043 -p1 -b .authorized-keys-principles-option %patch -P 1044 -p1 -b .proxyjump-username-validity-checks +%patch -P 1045 -p1 -b .scp-remote-glob %patch -P 100 -p1 -b .coverity @@ -750,6 +753,10 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185848 +- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed + in unintended parent directories when scp performs remote-to-remote copy + via the local host + Resolves: RHEL-193172 * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication From 1c775f820398f265d97da958814b34660edee2bd Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Tue, 14 Jul 2026 12:14:44 +0200 Subject: [PATCH 5/5] Fix CVE-2026-60002 Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193015 Signed-off-by: Zoltan Fridrich --- openssh-9.9p1-cve-2026-60002.patch | 191 +++++++++++++++++++++++++++++ openssh.spec | 5 + 2 files changed, 196 insertions(+) create mode 100644 openssh-9.9p1-cve-2026-60002.patch diff --git a/openssh-9.9p1-cve-2026-60002.patch b/openssh-9.9p1-cve-2026-60002.patch new file mode 100644 index 0000000..ab16479 --- /dev/null +++ b/openssh-9.9p1-cve-2026-60002.patch @@ -0,0 +1,191 @@ +diff --color -ruNp a/ssh.c b/ssh.c +--- a/ssh.c 2026-07-14 11:58:09.036496915 +0200 ++++ b/ssh.c 2026-07-14 12:00:55.044542741 +0200 +@@ -619,26 +619,6 @@ set_addrinfo_port(struct addrinfo *addrs + } + } + +-static void +-ssh_conn_info_free(struct ssh_conn_info *cinfo) +-{ +- if (cinfo == NULL) +- return; +- free(cinfo->conn_hash_hex); +- free(cinfo->shorthost); +- free(cinfo->uidstr); +- free(cinfo->keyalias); +- free(cinfo->thishost); +- free(cinfo->host_arg); +- free(cinfo->portstr); +- free(cinfo->remhost); +- free(cinfo->remuser); +- free(cinfo->homedir); +- free(cinfo->locuser); +- free(cinfo->jmphost); +- free(cinfo); +-} +- + /* + * Main program for the ssh client. + */ +@@ -1765,8 +1745,8 @@ main(int ac, char **av) + ssh_signal(SIGCHLD, main_sigchld_handler); + + /* Log into the remote system. Never returns if the login fails. */ +- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr, +- options.port, pw, timeout_ms, cinfo); ++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port, ++ pw, timeout_ms, cinfo); + + /* We no longer need the private host keys. Clear them now. */ + if (sensitive_data.nkeys != 0) { +diff --color -ruNp a/sshconnect2.c b/sshconnect2.c +--- a/sshconnect2.c 2026-07-14 11:58:09.031477028 +0200 ++++ b/sshconnect2.c 2026-07-14 12:01:56.374803123 +0200 +@@ -89,7 +89,7 @@ extern Options options; + */ + + static char *xxx_host; +-static struct sockaddr *xxx_hostaddr; ++static struct sockaddr_storage xxx_hostaddr; + static const struct ssh_conn_info *xxx_conn_info; + static int key_type_allowed(struct sshkey *, const char *); + +@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey * + fatal("Server host key %s not in HostKeyAlgorithms", + sshkey_ssh_name(hostkey)); + } +- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, ++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey, + xxx_conn_info) != 0) + fatal("Host key verification failed."); + return 0; +@@ -222,8 +222,8 @@ order_hostkeyalgs(char *host, struct soc + } + + void +-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, +- const struct ssh_conn_info *cinfo) ++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr, ++ u_short port, const struct ssh_conn_info *cinfo) + { + char *myproposal[PROPOSAL_MAX]; + char *all_key, *hkalgs = NULL, *filtered_algs = NULL; +@@ -234,9 +234,9 @@ ssh_kex2(struct ssh *ssh, char *host, st + char *gss_host = NULL; + #endif + +- xxx_host = host; +- xxx_hostaddr = hostaddr; +- xxx_conn_info = cinfo; ++ xxx_host = xstrdup(host); ++ xxx_hostaddr = *hostaddr; ++ xxx_conn_info = ssh_conn_info_dup(cinfo); + + if (options.rekey_limit || options.rekey_interval) + ssh_packet_set_rekey_limits(ssh, options.rekey_limit, +@@ -259,8 +259,10 @@ ssh_kex2(struct ssh *ssh, char *host, st + fatal_fr(r, "kex_assemble_namelist"); + free(all_key); + +- if (use_known_hosts_order) +- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo); ++ if (use_known_hosts_order) { ++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr, ++ port, cinfo); ++ } + + filtered_algs = hkalgs ? match_filter_allowlist(hkalgs, options.pubkey_accepted_algos) + : match_filter_allowlist(options.hostkeyalgorithms, +diff --color -ruNp a/sshconnect.c b/sshconnect.c +--- a/sshconnect.c 2026-07-14 11:58:08.892659011 +0200 ++++ b/sshconnect.c 2026-07-14 12:00:55.045767462 +0200 +@@ -84,6 +84,49 @@ extern char *__progname; + static int show_other_keys(struct hostkeys *, struct sshkey *); + static void warn_changed_key(struct sshkey *); + ++void ++ssh_conn_info_free(struct ssh_conn_info *cinfo) ++{ ++ if (cinfo == NULL) ++ return; ++ free(cinfo->conn_hash_hex); ++ free(cinfo->shorthost); ++ free(cinfo->uidstr); ++ free(cinfo->keyalias); ++ free(cinfo->thishost); ++ free(cinfo->host_arg); ++ free(cinfo->portstr); ++ free(cinfo->remhost); ++ free(cinfo->remuser); ++ free(cinfo->homedir); ++ free(cinfo->locuser); ++ free(cinfo->jmphost); ++ freezero(cinfo, sizeof(*cinfo)); ++} ++ ++struct ssh_conn_info * ++ssh_conn_info_dup(const struct ssh_conn_info *cinfo) ++{ ++ struct ssh_conn_info *ret; ++ ++ if (cinfo == NULL) ++ return NULL; ++ ret = xcalloc(1, sizeof(*ret)); ++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex); ++ ret->shorthost = xstrdup(cinfo->shorthost); ++ ret->uidstr = xstrdup(cinfo->uidstr); ++ ret->keyalias = xstrdup(cinfo->keyalias); ++ ret->thishost = xstrdup(cinfo->thishost); ++ ret->host_arg = xstrdup(cinfo->host_arg); ++ ret->portstr = xstrdup(cinfo->portstr); ++ ret->remhost = xstrdup(cinfo->remhost); ++ ret->remuser = xstrdup(cinfo->remuser); ++ ret->homedir = xstrdup(cinfo->homedir); ++ ret->locuser = xstrdup(cinfo->locuser); ++ ret->jmphost = xstrdup(cinfo->jmphost); ++ return ret; ++} ++ + /* Expand a proxy command */ + static char * + expand_proxy_command(const char *proxy_command, const char *user, +@@ -1589,8 +1632,8 @@ out: + */ + void + ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost, +- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms, +- const struct ssh_conn_info *cinfo) ++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw, ++ int timeout_ms, const struct ssh_conn_info *cinfo) + { + char *host; + char *server_user, *local_user; +diff --color -ruNp a/sshconnect.h b/sshconnect.h +--- a/sshconnect.h 2024-09-20 00:20:48.000000000 +0200 ++++ b/sshconnect.h 2026-07-14 12:00:55.045948953 +0200 +@@ -73,7 +73,7 @@ int ssh_connect(struct ssh *, const cha + void ssh_kill_proxy_command(void); + + void ssh_login(struct ssh *, Sensitive *, const char *, +- struct sockaddr *, u_short, struct passwd *, int, ++ struct sockaddr_storage *, u_short, struct passwd *, int, + const struct ssh_conn_info *); + + int verify_host_key(char *, struct sockaddr *, struct sshkey *, +@@ -82,7 +82,7 @@ int verify_host_key(char *, struct sock + void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short, + char **, char **); + +-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short, ++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short, + const struct ssh_conn_info *); + + void ssh_userauth2(struct ssh *ssh, const char *, const char *, +@@ -98,3 +98,6 @@ void load_hostkeys_command(struct hostk + const struct sshkey *, const char *); + + int hostkey_accepted_by_hostkeyalgs(const struct sshkey *); ++ ++void ssh_conn_info_free(struct ssh_conn_info *); ++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *); diff --git a/openssh.spec b/openssh.spec index c1254a1..c082bda 100644 --- a/openssh.spec +++ b/openssh.spec @@ -254,6 +254,8 @@ Patch1043: openssh-9.9p1-authorized-keys-principles-option.patch Patch1044: openssh-9.9p1-proxyjump-username-validity-checks.patch # upstream 36480181fa22f98e180b4f9e10203480c0346c78 Patch1045: openssh-9.9p1-scp-remote-glob.patch +# upstream e8bdfb151a356d0171fea4194dd205fbb252be23 +Patch1046: openssh-9.9p1-cve-2026-60002.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -463,6 +465,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1043 -p1 -b .authorized-keys-principles-option %patch -P 1044 -p1 -b .proxyjump-username-validity-checks %patch -P 1045 -p1 -b .scp-remote-glob +%patch -P 1046 -p1 -b .cve-2026-60002 %patch -P 100 -p1 -b .coverity @@ -757,6 +760,8 @@ test -f %{sysconfig_anaconda} && \ in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193172 +- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange + Resolves: RHEL-193015 * Tue Apr 14 2026 Dmitry Belyavskiy - 9.9p1-26 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication