SOURCES/openssh-8.0p1-CVE-2025-26465.patch

@@ -1,57 +0,0 @@
-diff --git a/openssh-8.0p1/krl.c b/openssh-8.0p1/krl.c
-index 8e2d5d5..e5b046d 100644
---- a/openssh-8.0p1/krl.c
-+++ b/openssh-8.0p1/krl.c
-@@ -676,6 +676,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
- 			break;
- 		case KRL_SECTION_CERT_SERIAL_BITMAP:
- 			if (rs->lo - bitmap_start > INT_MAX) {
-+				r = SSH_ERR_INVALID_FORMAT;
- 				error("%s: insane bitmap gap", __func__);
- 				goto out;
- 			}
-@@ -1011,6 +1012,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
- 		goto out;
- 
- 	if ((krl = ssh_krl_init()) == NULL) {
-+		r = SSH_ERR_ALLOC_FAIL;
- 		error("%s: alloc failed", __func__);
- 		goto out;
- 	}
-diff --git a/openssh-8.0p1/sshconnect2.c b/openssh-8.0p1/sshconnect2.c
-index ce855eb..9650b24 100644
---- a/openssh-8.0p1/sshconnect2.c
-+++ b/openssh-8.0p1/sshconnect2.c
-@@ -95,7 +95,7 @@ struct sockaddr *xxx_hostaddr;
- static int
- verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
- {
--	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
-+	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) != 0)
- 		fatal("Host key verification failed.");
- 	return 0;
- }
-@@ -767,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
- 
- 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
- 		debug("%s: server sent unknown pkalg %s", __func__, pkalg);
-+		r = SSH_ERR_INVALID_FORMAT;
- 		goto done;
- 	}
- 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
-@@ -777,6 +778,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
- 		error("input_userauth_pk_ok: type mismatch "
- 		    "for decoded key (received %d, expected %d)",
- 		    key->type, pktype);
-+		r = SSH_ERR_INVALID_FORMAT;
- 		goto done;
- 	}
- 
-@@ -796,6 +798,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
- 		    SSH_FP_DEFAULT);
- 		error("%s: server replied with unknown key: %s %s", __func__,
- 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
-+		r = SSH_ERR_INVALID_FORMAT;
- 		goto done;
- 	}
- 	ident = format_identity(id);

SOURCES/openssh-8.0p1-reject-cntrl-chars-in-username.patch

@@ -1,12 +0,0 @@
-diff --color -ruNp a/ssh.c b/ssh.c
---- a/ssh.c	2025-12-10 11:51:34.927545274 +0100
-+++ b/ssh.c	2025-12-10 12:05:26.210486999 +0100
-@@ -599,6 +599,8 @@ valid_ruser(const char *s)
- 	if (*s == '-')
- 		return 0;
- 	for (i = 0; s[i] != 0; i++) {
-+		if (iscntrl((u_char)s[i]))
-+			return 0;
- 		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
- 			return 0;
- 		/* Disallow '-' after whitespace */

SOURCES/openssh-8.0p1-upstream-ignore-SIGPIPE.patch

@@ -1,38 +0,0 @@
-From d33ff14309e33aa79fdf95e1bc4facafa80b90a9 Mon Sep 17 00:00:00 2001
-From: Stepan Broz <sbroz@redhat.com>
-Date: Tue, 25 Jun 2024 17:38:22 +0200
-Subject: [PATCH] upstream: ignore SIGPIPE earlier in main(), specifically
- before
-
-muxclient() which performs operations that could cause one; Reported by Noam
-Lewis via bz3454, ok dtucker@
-
-OpenBSD-Commit-ID: 63d8e13276869eebac6d7a05d5a96307f9026e47
----
- ssh.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/ssh.c b/ssh.c
-index 786e26d..e037c66 100644
---- a/ssh.c
-+++ b/ssh.c
-@@ -1115,6 +1115,8 @@ main(int ac, char **av)
- 		}
- 	}
- 
-+	signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
-+
- 	/*
- 	 * Initialize "log" output.  Since we are the client all output
- 	 * goes to stderr unless otherwise specified by -y or -E.
-@@ -1545,7 +1547,6 @@ main(int ac, char **av)
- 	    options.num_system_hostfiles);
- 	tilde_expand_paths(options.user_hostfiles, options.num_user_hostfiles);
- 
--	signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
- 	signal(SIGCHLD, main_sigchld_handler);
- 
- 	/* Log into the remote system.  Never returns if the login fails. */
--- 
-2.45.2
-

SOURCES/openssh-8.7p1-reject-null-char-in-url-string.patch

@@ -1,15 +0,0 @@
-diff --color -ruNp a/misc.c b/misc.c
---- a/misc.c	2025-12-09 17:16:21.637368818 +0100
-+++ b/misc.c	2025-12-09 17:48:22.679192853 +0100
-@@ -936,9 +936,10 @@ urldecode(const char *src)
- 			*dst++ = ' ';
- 			break;
- 		case '%':
-+			/* note: don't allow \0 characters */
- 			if (!isxdigit((unsigned char)src[1]) ||
- 			    !isxdigit((unsigned char)src[2]) ||
--			    (ch = hexchar(src + 1)) == -1) {
-+			    (ch = hexchar(src + 1)) == -1 || ch == 0) {
- 				free(ret);
- 				return NULL;
- 			}

SPECS/openssh.spec

@@ -66,7 +66,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.0p1
-%global openssh_rel 27
+%global openssh_rel 24
 %global pam_ssh_agent_ver 0.10.3
 %global pam_ssh_agent_rel 7
 
@@ -292,14 +292,6 @@ Patch1018: openssh-9.6p1-CVE-2023-48795.patch
 Patch1019: openssh-9.6p1-CVE-2023-51385.patch
 # SCP kill switch
 Patch1020: openssh-8.7p1-scp-kill-switch.patch
-#upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
-Patch1021: openssh-8.0p1-upstream-ignore-SIGPIPE.patch
-#upstream commit 0832aac79517611dd4de93ad0a83577994d9c907
-Patch1022: openssh-8.0p1-CVE-2025-26465.patch
-# upstream 35d5917652106aede47621bb3f64044604164043
-Patch1023: openssh-8.0p1-reject-cntrl-chars-in-username.patch
-# upstream 43b3bff47bb029f2299bacb6a36057981b39fdb0
-Patch1024: openssh-8.7p1-reject-null-char-in-url-string.patch
 
 License: BSD
 Group: Applications/Internet
@@ -547,10 +539,6 @@ popd
 %patch1018 -p1 -b .cve-2023-48795
 %patch1019 -p1 -b .cve-2023-51385
 %patch1020 -p1 -b .scp-kill-switch
-%patch1021 -p1 -b .ignore-SIGPIPE
-%patch1022 -p2 -b .cve-2025-26465
-%patch1023 -p1 -b .reject-cntrl-chars-in-username
-%patch1024 -p1 -b .reject-null-char-in-url-string
 
 autoreconf
 pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -836,21 +824,6 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
-* Wed Dec 10 2025 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-27
-- CVE-2025-61984: Reject usernames with control characters
-  Resolves: RHEL-128400
-- CVE-2025-61985: Reject URL-strings with NULL characters
-  Resolves: RHEL-128390
-
-* Wed Aug 20 2025 Antonio Vieiro <avieirov@redhat.com> - 8.0p1-26
-- Fix missing invalid error code checks in OpenSSH. It prevents
-  a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465)
-  Resolves: RHEL-109228
-
-* Tue Jun 25 2024 Stepan Broz <sbroz@redhat.com> - 8.0p1-25
-- Upstream: Ignore SIGPIPE earlier in main()
-  Resolves: RHEL-37743
-
 * Tue Feb 06 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-24
 - Providing a kill switch for scp to deal with CVE-2020-15778
   Resolves: RHEL-22870