Backport upstream fix (commit 8dfe7ed6) for CVE-2026-59999
where DisableForwarding=yes did not properly override
PermitTunnel=yes, allowing tunnel device forwarding requests
to be accepted when they should have been rejected. The fix
adds a check for options.disable_forwarding in the
server_request_tun() function in serverloop.c.
CVE: CVE-2026-59999
Upstream patches:
- 8dfe7ed6e2.patch
Resolves: RHEL-236280
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-59995 to openssh-8.0p1. The upstream
commit fixes a vulnerability in sftp where a download on the
commandline could be directed to a server-controlled path. The
fix replaces the vulnerable code pattern (which built a command
string via snprintf and parsed it with parse_dispatch_command)
with a direct call to process_get(), bypassing the command
parsing entirely. Added as Patch1030.
CVE: CVE-2026-59995
Upstream patches:
- 1b39f39657.patch
Resolves: RHEL-236324
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Fix double free in openssh DH-GEX client path
during FIPS known-group validation that leads
to client-side denial of service
Resolves: RHEL-185775
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Add validation rules to usernames and hostnames
set for ProxyJump/-J on the commandline
Resolves: RHEL-166208
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Fix incomplete application of PubkeyAcceptedAlgorithms
and HostbasedAcceptedAlgorithms with regard to ECDSA keys
Resolves: RHEL-166224
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Fix privilege escalation via scp legacy protocol
when not in preserving file mode
Resolves: RHEL-164743
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Fix information disclosure or denial of service due
to uninitialized variables in gssapi-keyex
Resolves: RHEL-155814
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
