On Mon Jul 20, 2026 at 7:55 PM CEST, Devansh Patel via lists.openembedded.org wrote: > From: Devansh Patel <[email protected]> > > This patch applies the upstream OpenSSH 10.4p1 backport for > CVE-2026-59998. The upstream fix commit is referenced in [1], > and the public CVE advisory is referenced in [2]. > > [1] > https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432 > [2] https://www.cve.org/CVERecord?id=CVE-2026-59998 > > Signed-off-by: Devansh Patel <[email protected]> > --- > .../openssh/openssh/CVE-2026-59998.patch | 36 +++++++++++++++++++ > .../openssh/openssh_10.3p1.bb | 1 + > 2 files changed, 37 insertions(+) > create mode 100644 > meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch > > diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch > b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch > new file mode 100644 > index 0000000000..3e15fe19fa > --- /dev/null > +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch > @@ -0,0 +1,36 @@ > +From 94a089cd331eeea77ffd6fd715e61d281c3b97c3 Mon Sep 17 00:00:00 2001 > +From: "[email protected]" <[email protected]> > +Date: Wed, 24 Jun 2026 06:55:12 +0000 > +Subject: [PATCH] upstream: mention a caveat regarding > + GSSAPIStrictAcceptorCheck in > + > +some environments > + > +OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2 > + > +CVE: CVE-2026-59998 > +Upstream-Status: Backport > [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432] > + > +Backport Changes: > +- Omitted the upstream OpenBSD revision and Mdocdate-only hunks in > + sshd_config.5 and retained the Wrynose OpenSSH 10.3p1 values because > + this stable backport carries only the security-relevant documentation. > + > +(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432) > +Signed-off-by: Devansh Patel <[email protected]> > +--- > + sshd_config.5 | 1 + > + 1 file changed, 1 insertion(+) > + > +diff --git a/sshd_config.5 b/sshd_config.5 > +index 3f5e29812..22b9039d2 100644 > +--- a/sshd_config.5 > ++++ b/sshd_config.5 > +@@ -769,6 +769,7 @@ machine's default store. > + This facility is provided to assist with operation on multi homed machines. > + The default is > + .Cm yes . > ++This option may not be effective in Windows Active Directory environments.
This is a oneline manpage patch for "Windows Active Directory environments.". I'm not expert in GSSAPI but can we even trigger this? If not, I think this should be handled with a CVE_STATUS. I'll hold this patch in the meantime. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241540): https://lists.openembedded.org/g/openembedded-core/message/241540 Mute This Topic: https://lists.openembedded.org/mt/120363508/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
