From: Devansh Patel <[email protected]> This series backports security fixes from OpenSSH 10.4 to the OpenSSH 9.6p1 recipe in Scarthgap. The relevant upstream fixes are carried as individual patches instead of upgrading the stable-branch recipe.
- CVE-2026-59995: Command-line SCP downloads could use a path controlled by the server. Fixed by retaining the client-selected destination path rather than allowing the server response to redirect the download. Upstream: https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b - CVE-2026-59996: A remote glob could return ".." during remote-to-remote copies and escape the expected path handling. Fixed by rejecting the parent-directory result, matching the existing remote-to-local protection. Upstream: https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78 - CVE-2026-59997: The internal-sftp server silently dropped command-line arguments after the ninth argument. Fixed by passing the complete argument vector to internal-sftp. Upstream: https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014 - CVE-2026-59998: Some environments require special consideration when using GSSAPIStrictAcceptorCheck. Fixed by documenting the configuration caveat in the upstream manual page. Upstream: https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432 - CVE-2026-59999: DisableForwarding=yes did not override PermitTunnel=yes. Fixed by including tunnel permission in the DisableForwarding policy enforcement. Upstream: https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753 - CVE-2026-60000: Multiple RFC 4462 GSSAPI authentication issues caused different behavior for valid and invalid accounts, incomplete MaxAuthTries enforcement, and a moderate pre-authentication resource denial of service. Fixed by aligning failure handling, applying attempt limits consistently, and adding missing error logging. Upstream: https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192 - CVE-2026-60001: GSSAPI and keyboard-interactive authentication paths did not always enforce the minimum per-attempt delay. Fixed by applying the delay consistently to the affected authentication failures. Upstream: https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454 - CVE-2026-60002: Several pieces of client state had incorrect ownership or lifetime, including a cached host key that could be freed too early and subsequently used. Fixed by retaining connection-scoped state for the full lifetime of the connection. Upstream: https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23 Each fix is kept in a separate commit for independent review and CVE tracking. The OpenSSH recipe applies the patches in series order. Validation: - Built openssh successfully after applying the full series. - Built core-image-minimal successfully with ptest packages enabled. Devansh Patel (8): openssh: Fix CVE-2026-59999 openssh: Fix CVE-2026-59997 openssh: Fix CVE-2026-59998 openssh: Fix CVE-2026-59996 openssh: Fix CVE-2026-59995 openssh: Fix CVE-2026-60001 openssh: Fix CVE-2026-60002 openssh: Fix CVE-2026-60000 .../openssh/openssh/CVE-2026-59995.patch | 42 ++++ .../openssh/openssh/CVE-2026-59996.patch | 37 +++ .../openssh/openssh/CVE-2026-59997.patch | 58 +++++ .../openssh/openssh/CVE-2026-59998.patch | 34 +++ .../openssh/openssh/CVE-2026-59999.patch | 36 +++ .../openssh/openssh/CVE-2026-60000.patch | 140 +++++++++++ .../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++ .../openssh/openssh/CVE-2026-60002.patch | 226 ++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 8 + 9 files changed, 711 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch -- 2.44.4
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241480): https://lists.openembedded.org/g/openembedded-core/message/241480 Mute This Topic: https://lists.openembedded.org/mt/120364589/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
