diff --git a/SOURCES/openssh-10.4p1-CVE-2026-59995.patch b/SOURCES/openssh-10.4p1-CVE-2026-59995.patch new file mode 100644 index 0000000..0ba8388 --- /dev/null +++ b/SOURCES/openssh-10.4p1-CVE-2026-59995.patch @@ -0,0 +1,20 @@ +diff --git a/sftp.c b/sftp.c +index 0ab9206c2..0b57e0833 100644 +--- a/sftp.c ++++ b/sftp.c +@@ -2289,13 +2289,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2) + return (-1); + } + } else { +- /* XXX this is wrong wrt quoting */ +- snprintf(cmd, sizeof cmd, "get%s %s%s%s", +- global_aflag ? " -a" : "", dir, +- file2 == NULL ? "" : " ", +- file2 == NULL ? "" : file2); +- err = parse_dispatch_command(conn, cmd, +- &remote_path, startdir, 1, 0); ++ err = process_get(conn, dir, file2, remote_path, 0, 0, ++ global_aflag, 0); + free(dir); + free(startdir); + free(remote_path); diff --git a/SOURCES/openssh-10.4p1-CVE-2026-59999.patch b/SOURCES/openssh-10.4p1-CVE-2026-59999.patch new file mode 100644 index 0000000..b1bf58c --- /dev/null +++ b/SOURCES/openssh-10.4p1-CVE-2026-59999.patch @@ -0,0 +1,78 @@ +diff --git a/auth-options.c b/auth-options.c +index e15f600ab..c5fc4e59c 100644 +--- a/auth-options.c ++++ b/auth-options.c +@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void) + ret->permit_x11_forwarding_flag = 1; + ret->permit_pty_flag = 1; + ret->permit_user_rc = 1; ++ ret->permit_tun_flag = 1; + return ret; + } + +@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp) + ret->permit_x11_forwarding_flag = 0; + ret->permit_pty_flag = 0; + ret->permit_user_rc = 0; ++ ret->permit_tun_flag = 0; + } else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) { + ret->cert_authority = r; + } else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) { +@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary, + OPTFLAG_AND(permit_x11_forwarding_flag); + OPTFLAG_AND(permit_pty_flag); + OPTFLAG_AND(permit_user_rc); ++ OPTFLAG_AND(permit_tun_flag); + OPTFLAG_AND(no_require_user_presence); + /* Restrictive flags are logical-OR (i.e. must be set in either) */ + OPTFLAG_OR(require_verify); +@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig) + OPTSCALAR(permit_x11_forwarding_flag); + OPTSCALAR(permit_pty_flag); + OPTSCALAR(permit_user_rc); ++ OPTSCALAR(permit_tun_flag); + OPTSCALAR(restricted); + OPTSCALAR(cert_authority); + OPTSCALAR(force_tun_device); +@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m, + (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 || + (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 || + (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 || ++ (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 || + (r = sshbuf_put_u8(m, opts->restricted)) != 0 || + (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 || + (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 || +@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp) + OPT_FLAG(permit_x11_forwarding_flag); + OPT_FLAG(permit_pty_flag); + OPT_FLAG(permit_user_rc); ++ OPT_FLAG(permit_tun_flag); + OPT_FLAG(restricted); + OPT_FLAG(cert_authority); + OPT_FLAG(no_require_user_presence); +diff --git a/auth-options.h b/auth-options.h +index 6e29b727c..191b9b249 100644 +--- a/auth-options.h ++++ b/auth-options.h +@@ -39,6 +39,7 @@ struct sshauthopt { + int permit_x11_forwarding_flag; + int permit_pty_flag; + int permit_user_rc; ++ int permit_tun_flag; + + /* "restrict" keyword was invoked */ + int restricted; +diff --git a/serverloop.c b/serverloop.c +index 8a6e3db80..cf5243f80 100644 +--- a/serverloop.c ++++ b/serverloop.c +@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh) + ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); + return NULL; + } +- if ((options.permit_tun & mode) == 0) { ++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding || ++ !auth_opts->permit_tun_flag) { + ssh_packet_send_debug(ssh, "Server has rejected tunnel device " + "forwarding"); + return NULL; diff --git a/SOURCES/openssh-10.5p1-CVE-2026-73281.patch b/SOURCES/openssh-10.5p1-CVE-2026-73281.patch new file mode 100644 index 0000000..b59ec35 --- /dev/null +++ b/SOURCES/openssh-10.5p1-CVE-2026-73281.patch @@ -0,0 +1,42 @@ +diff --git a/ssh-agent.c b/ssh-agent.c +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e) + error_fr(r, "parse"); + goto send; + } ++ ++ /* ++ * This function can be called while the agent is locked to allow ++ * session binds to be processed for new channels. ++ * Other operations should be refused when locked. ++ */ ++ + if (strcmp(name, "session-bind@openssh.com") == 0) + success = process_ext_session_bind(e); ++ else if (locked) ++ debug_f("attempt to use extension \"%s\" while locked", name); + else + debug_f("unsupported extension \"%s\"", name); + free(name); +@@ -1892,16 +1901,19 @@ process_message(u_int socknum) + + /* check whether agent is locked */ + if (locked && type != SSH_AGENTC_UNLOCK) { +- sshbuf_reset(e->request); + switch (type) { + case SSH2_AGENTC_REQUEST_IDENTITIES: + /* send empty lists */ + no_identities(e); + break; ++ case SSH_AGENTC_EXTENSION: ++ process_extension(e); ++ break; + default: + /* send a fail message for all other request types */ + send_status(e, 0); + } ++ sshbuf_reset(e->request); + return 1; + } + diff --git a/SOURCES/openssh-10.5p1-CVE-2026-73282.patch b/SOURCES/openssh-10.5p1-CVE-2026-73282.patch new file mode 100644 index 0000000..a4c4973 --- /dev/null +++ b/SOURCES/openssh-10.5p1-CVE-2026-73282.patch @@ -0,0 +1,51 @@ +diff --git a/ssh.c b/ssh.c +--- a/ssh.c ++++ b/ssh.c +@@ -1862,14 +1862,24 @@ + } + } + ++struct rfwd_confirm_ctx { ++ int fid; ++}; ++ + /* Callback for remote forward global requests */ + static void + ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) + { +- struct Forward *rfwd = (struct Forward *)ctxt; ++ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt; ++ struct Forward *rfwd; + u_int port; + int r; + ++ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards) ++ fatal_f("invalid forwarding ID %d", rctx->fid); ++ rfwd = &options.remote_forwards[rctx->fid]; ++ freezero(rctx, sizeof(*rctx)); ++ + /* XXX verbose() on failure? */ + debug("remote forward %s for: listen %s%s%d, connect %s:%d", + type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", +@@ -2047,6 +2057,8 @@ + + /* Initiate remote TCP/IP port forwardings. */ + for (i = 0; i < options.num_remote_forwards; i++) { ++ struct rfwd_confirm_ctx *rctx; ++ + debug("Remote connections from %.200s:%d forwarded to " + "local address %.200s:%d", + (options.remote_forwards[i].listen_path != NULL) ? +@@ -2061,9 +2073,10 @@ + if ((options.remote_forwards[i].handle = + channel_request_remote_forwarding(ssh, + &options.remote_forwards[i])) >= 0) { ++ rctx = xcalloc(1, sizeof(*rctx)); ++ rctx->fid = i; + client_register_global_confirm( +- ssh_confirm_remote_forward, +- &options.remote_forwards[i]); ++ ssh_confirm_remote_forward, rctx); + forward_confirms_pending++; + } else if (options.exit_on_forward_failure) + fatal("Could not request remote forwarding."); diff --git a/SPECS/openssh.spec b/SPECS/openssh.spec index f5aca32..3ed3029 100644 --- a/SPECS/openssh.spec +++ b/SPECS/openssh.spec @@ -47,9 +47,9 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 9.9p1 -%global openssh_rel 11 +%global openssh_rel 13 %global pam_ssh_agent_ver 0.10.4 -%global pam_ssh_agent_rel 9 +%global pam_ssh_agent_rel 10 Summary: An open source implementation of SSH protocol version 2 Name: openssh @@ -269,6 +269,17 @@ Patch1047: openssh-9.9p1-cve-2026-60002.patch # upstream eddd1d2daa64a6ab1a915ca88436fa41aede44d4 # upstream bc328144f149af07139a0f2c1329018cd85b86b7 Patch1048: openssh-9.9p1-maxstartups-mistracking.patch +# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f +Patch1049: openssh-10.4p1-CVE-2026-59995.patch +# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753 +# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0 +# combines CVE-2026-59999 and CVE-2026-73283 +# downstream specific fix, drop on rebase +Patch1050: openssh-10.4p1-CVE-2026-59999.patch +# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f +Patch1051: openssh-10.5p1-CVE-2026-73281.patch +# upstream 9910d5ef53124ce1157d57bc11e222658aa41299 +Patch1052: openssh-10.5p1-CVE-2026-73282.patch License: BSD @@ -492,6 +503,10 @@ popd %patch1046 -p1 -b .scp-remote-glob %patch1047 -p1 -b .cve-2026-60002 %patch1048 -p1 -b .maxstartups-mistracking +%patch1049 -p1 -b .CVE-2026-59995 +%patch1050 -p1 -b .CVE-2026-59999 +%patch1051 -p1 -b .CVE-2026-73281 +%patch1052 -p1 -b .CVE-2026-73282 %patch100 -p1 -b .coverity @@ -782,9 +797,28 @@ test -f %{sysconfig_anaconda} && \ %endif %changelog -* Mon Aug 24 2026 Koichiro Iwao - 9.9p1-11.alma.1 +* Thu Sep 03 2026 Koichiro Iwao - 9.9p1-13.alma.1 - Unpatch Red Hat help message +* Fri Aug 21 2026 Zoltan Fridrich - 9.9p1-13 +- CVE-2026-73283: Complete the fix of security bypass due to incorrect + handling of forwarding and tunneling options + Resolves: RHEL-245414 +- CVE-2026-73281: Fix misinteraction between agent locking and + the session-bind@openssh.com extension + Resolves: RHEL-245422 +- CVE-2026-73282: Fix information disclosure and data corruption + via use-after-free in ssh client + Resolves: RHEL-245420 + +* Wed Aug 12 2026 Dmitry Belyavskiy - 9.9p1-12 +- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded + file location + Resolves: RHEL-236326 +- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect + handling of forwarding and tunneling options + Resolves: RHEL-236284 + * Thu Jul 30 2026 Zoltan Fridrich - 9.9p1-11 - Fix mistracking of MaxStartups process exits in some situations Resolves: RHEL-216650