Backport fix for CVE-2026-59995 to openssh-8.0p1. The upstream
commit fixes a vulnerability in sftp where a download on the
commandline could be directed to a server-controlled path. The
fix replaces the vulnerable code pattern (which built a command
string via snprintf and parsed it with parse_dispatch_command)
with a direct call to process_get(), bypassing the command
parsing entirely. Added as Patch1030.
CVE: CVE-2026-59995
Upstream patches:
- 1b39f39657.patch
Resolves: RHEL-236324
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Fix double free in openssh DH-GEX client path
during FIPS known-group validation that leads
to client-side denial of service
Resolves: RHEL-185775
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Add validation rules to usernames and hostnames
set for ProxyJump/-J on the commandline
Resolves: RHEL-166208
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Fix incomplete application of PubkeyAcceptedAlgorithms
and HostbasedAcceptedAlgorithms with regard to ECDSA keys
Resolves: RHEL-166224
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Fix privilege escalation via scp legacy protocol
when not in preserving file mode
Resolves: RHEL-164743
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
Fix information disclosure or denial of service due
to uninitialized variables in gssapi-keyex
Resolves: RHEL-155814
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
