rpms/openssh
7
0
Fork 2
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73283

Browse Source 
Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options

Resolves: RHEL-242759

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
This commit is contained in:
Zoltan Fridrich 2026-08-21 12:02:06 +02:00
parent 5dc3c53a89
commit d3793c1b8d
2 changed files with 73 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
openssh-10.4p1-CVE-2026-59999.patch
View File

@ -1,5 +1,69 @@
diff --git a/auth-options.c b/auth-options.c
index e15f600ab..c5fc4e59c 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void)
ret->permit_x11_forwarding_flag = 1;
ret->permit_pty_flag = 1;
ret->permit_user_rc = 1;
+ ret->permit_tun_flag = 1;
return ret;
}
@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
ret->permit_x11_forwarding_flag = 0;
ret->permit_pty_flag = 0;
ret->permit_user_rc = 0;
+ ret->permit_tun_flag = 0;
} else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
ret->cert_authority = r;
} else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
OPTFLAG_AND(permit_x11_forwarding_flag);
OPTFLAG_AND(permit_pty_flag);
OPTFLAG_AND(permit_user_rc);
+ OPTFLAG_AND(permit_tun_flag);
OPTFLAG_AND(no_require_user_presence);
/* Restrictive flags are logical-OR (i.e. must be set in either) */
OPTFLAG_OR(require_verify);
@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig)
OPTSCALAR(permit_x11_forwarding_flag);
OPTSCALAR(permit_pty_flag);
OPTSCALAR(permit_user_rc);
+ OPTSCALAR(permit_tun_flag);
OPTSCALAR(restricted);
OPTSCALAR(cert_authority);
OPTSCALAR(force_tun_device);
@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
(r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
+ (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 ||
(r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
(r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
(r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
OPT_FLAG(permit_x11_forwarding_flag);
OPT_FLAG(permit_pty_flag);
OPT_FLAG(permit_user_rc);
+ OPT_FLAG(permit_tun_flag);
OPT_FLAG(restricted);
OPT_FLAG(cert_authority);
OPT_FLAG(no_require_user_presence);
diff --git a/auth-options.h b/auth-options.h
index 6e29b727c..191b9b249 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -39,6 +39,7 @@ struct sshauthopt {
int permit_x11_forwarding_flag;
int permit_pty_flag;
int permit_user_rc;
+ int permit_tun_flag;
/* "restrict" keyword was invoked */
int restricted;
diff --git a/serverloop.c b/serverloop.c
index 8a6e3db80..9d8a3429e 100644
index 8a6e3db80..cf5243f80 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
@ -8,7 +72,7 @@ index 8a6e3db80..9d8a3429e 100644
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
+ auth_opts->restricted) {
+ !auth_opts->permit_tun_flag) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;

8
openssh.spec
View File

@ -43,7 +43,7 @@
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
Release: 29%{?dist}
Release: 30%{?dist}
URL: http://www.openssh.com/portable.html
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@ -264,6 +264,7 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch
# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
# combines CVE-2026-59999 and CVE-2026-73283
# downstream specific fix, drop on rebase
Patch1049: openssh-10.4p1-CVE-2026-59999.patch
License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
@ -758,6 +759,11 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
* Fri Aug 21 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-30
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-242759
* Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location