Bump pam_ssh_agent_auth Release

SOURCES/openssh-8.0p1-reject-cntrl-chars-in-username.patch

@@ -1,12 +0,0 @@
-diff --color -ruNp a/ssh.c b/ssh.c
---- a/ssh.c	2025-12-10 11:51:34.927545274 +0100
-+++ b/ssh.c	2025-12-10 12:05:26.210486999 +0100
-@@ -599,6 +599,8 @@ valid_ruser(const char *s)
- 	if (*s == '-')
- 		return 0;
- 	for (i = 0; s[i] != 0; i++) {
-+		if (iscntrl((u_char)s[i]))
-+			return 0;
- 		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
- 			return 0;
- 		/* Disallow '-' after whitespace */

SOURCES/openssh-8.7p1-reject-null-char-in-url-string.patch

@@ -1,15 +0,0 @@
-diff --color -ruNp a/misc.c b/misc.c
---- a/misc.c	2025-12-09 17:16:21.637368818 +0100
-+++ b/misc.c	2025-12-09 17:48:22.679192853 +0100
-@@ -936,9 +936,10 @@ urldecode(const char *src)
- 			*dst++ = ' ';
- 			break;
- 		case '%':
-+			/* note: don't allow \0 characters */
- 			if (!isxdigit((unsigned char)src[1]) ||
- 			    !isxdigit((unsigned char)src[2]) ||
--			    (ch = hexchar(src + 1)) == -1) {
-+			    (ch = hexchar(src + 1)) == -1 || ch == 0) {
- 				free(ret);
- 				return NULL;
- 			}

SOURCES/openssh-9.9p2-CVE-2025-26465.patch

@@ -1,8 +1,9 @@
-diff --git a/openssh-8.0p1/krl.c b/openssh-8.0p1/krl.c
+Description: fix MitM with VerifyHostKeyDNS option
-index 8e2d5d5..e5b046d 100644
+Origin: backported from patch provided by upstream to Qualys
---- a/openssh-8.0p1/krl.c
+
-+++ b/openssh-8.0p1/krl.c
+--- a/krl.c
-@@ -676,6 +676,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
++++ b/krl.c
+@@ -677,6 +677,7 @@ revoked_certs_generate(struct revoked_ce
  			break;
  		case KRL_SECTION_CERT_SERIAL_BITMAP:
  			if (rs->lo - bitmap_start > INT_MAX) {
@@ -10,7 +11,7 @@ index 8e2d5d5..e5b046d 100644
  				error("%s: insane bitmap gap", __func__);
  				goto out;
  			}
-@@ -1011,6 +1012,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp,
+@@ -1012,6 +1013,7 @@ ssh_krl_from_blob(struct sshbuf *buf, st
  		goto out;
  
  	if ((krl = ssh_krl_init()) == NULL) {
@@ -18,10 +19,8 @@ index 8e2d5d5..e5b046d 100644
  		error("%s: alloc failed", __func__);
  		goto out;
  	}
-diff --git a/openssh-8.0p1/sshconnect2.c b/openssh-8.0p1/sshconnect2.c
+--- a/sshconnect2.c
-index ce855eb..9650b24 100644
++++ b/sshconnect2.c
---- a/openssh-8.0p1/sshconnect2.c
-+++ b/openssh-8.0p1/sshconnect2.c
 @@ -95,7 +95,7 @@ struct sockaddr *xxx_hostaddr;
  static int
  verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
@@ -31,7 +30,7 @@ index ce855eb..9650b24 100644
  		fatal("Host key verification failed.");
  	return 0;
  }
-@@ -767,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+@@ -756,6 +756,7 @@ input_userauth_pk_ok(int type, u_int32_t
  
  	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
  		debug("%s: server sent unknown pkalg %s", __func__, pkalg);
@@ -39,7 +38,7 @@ index ce855eb..9650b24 100644
  		goto done;
  	}
  	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
-@@ -777,6 +778,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+@@ -766,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t
  		error("input_userauth_pk_ok: type mismatch "
  		    "for decoded key (received %d, expected %d)",
  		    key->type, pktype);
@@ -47,7 +46,7 @@ index ce855eb..9650b24 100644
  		goto done;
  	}
  
-@@ -796,6 +798,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
+@@ -785,6 +787,7 @@ input_userauth_pk_ok(int type, u_int32_t
  		    SSH_FP_DEFAULT);
  		error("%s: server replied with unknown key: %s %s", __func__,
  		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);

SPECS/openssh.spec

@@ -66,14 +66,14 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.0p1
-%global openssh_rel 27
+%global openssh_rel 25
 %global pam_ssh_agent_ver 0.10.3
 %global pam_ssh_agent_rel 7
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: %{openssh_rel}%{?dist}%{?rescue_rel}
+Release: %{openssh_rel}%{?dist}%{?rescue_rel}.alma.1
 URL: http://www.openssh.com/portable.html
 #URL1: http://pamsshagentauth.sourceforge.net
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
@@ -294,12 +294,9 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch
 Patch1020: openssh-8.7p1-scp-kill-switch.patch
 #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
 Patch1021: openssh-8.0p1-upstream-ignore-SIGPIPE.patch
-#upstream commit 0832aac79517611dd4de93ad0a83577994d9c907
+# upstream commit 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
-Patch1022: openssh-8.0p1-CVE-2025-26465.patch
+# upstream commit 0832aac79517611dd4de93ad0a83577994d9c907
-# upstream 35d5917652106aede47621bb3f64044604164043
+Patch1022: openssh-9.9p2-CVE-2025-26465.patch
-Patch1023: openssh-8.0p1-reject-cntrl-chars-in-username.patch
-# upstream 43b3bff47bb029f2299bacb6a36057981b39fdb0
-Patch1024: openssh-8.7p1-reject-null-char-in-url-string.patch
 
 License: BSD
 Group: Applications/Internet
@@ -392,7 +389,7 @@ Requires: openssh = %{version}-%{release}
 Summary: PAM module for authentication with ssh-agent
 Group: System Environment/Base
 Version: %{pam_ssh_agent_ver}
-Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}
+Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}%{?rescue_rel}.alma.1
 License: BSD
 
 %description
@@ -548,9 +545,8 @@ popd
 %patch1019 -p1 -b .cve-2023-51385
 %patch1020 -p1 -b .scp-kill-switch
 %patch1021 -p1 -b .ignore-SIGPIPE
-%patch1022 -p2 -b .cve-2025-26465
+
-%patch1023 -p1 -b .reject-cntrl-chars-in-username
+%patch1022 -p1 -b .cve-2025-26465
-%patch1024 -p1 -b .reject-null-char-in-url-string
 
 autoreconf
 pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -836,16 +832,11 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
-* Wed Dec 10 2025 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-27
+* Wed Feb 19 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 8.0p1-25.alma.1
-- CVE-2025-61984: Reject usernames with control characters
+- Fix missing error codes set and invalid error code checks in OpenSSH. It
-  Resolves: RHEL-128400
+  prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
-- CVE-2025-61985: Reject URL-strings with NULL characters
+  is on (CVE-2025-26465).
-  Resolves: RHEL-128390
+  Resolves: RHEL-78700
-
-* Wed Aug 20 2025 Antonio Vieiro <avieirov@redhat.com> - 8.0p1-26
-- Fix missing invalid error code checks in OpenSSH. It prevents
-  a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465)
-  Resolves: RHEL-109228
 
 * Tue Jun 25 2024 Stepan Broz <sbroz@redhat.com> - 8.0p1-25
 - Upstream: Ignore SIGPIPE earlier in main()