mbox series

[scarthgap,0/8] openssh: Security fixes

Message ID 20260720185749.4098075-1-devanshp@cisco.com
Headers show
Series openssh: Security fixes | expand

Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) July 20, 2026, 6:57 p.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

This series backports security fixes from OpenSSH 10.4 to the OpenSSH
9.6p1 recipe in Scarthgap. The relevant upstream fixes are carried as
individual patches instead of upgrading the stable-branch recipe.

- CVE-2026-59995: Command-line SCP downloads could use a path controlled
  by the server. Fixed by retaining the client-selected destination path
  rather than allowing the server response to redirect the download.
  Upstream: https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b

- CVE-2026-59996: A remote glob could return ".." during remote-to-remote
  copies and escape the expected path handling. Fixed by rejecting the
  parent-directory result, matching the existing remote-to-local
  protection.
  Upstream: https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78

- CVE-2026-59997: The internal-sftp server silently dropped command-line
  arguments after the ninth argument. Fixed by passing the complete
  argument vector to internal-sftp.
  Upstream: https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014

- CVE-2026-59998: Some environments require special consideration when
  using GSSAPIStrictAcceptorCheck. Fixed by documenting the configuration
  caveat in the upstream manual page.
  Upstream: https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432

- CVE-2026-59999: DisableForwarding=yes did not override
  PermitTunnel=yes. Fixed by including tunnel permission in the
  DisableForwarding policy enforcement.
  Upstream: https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753

- CVE-2026-60000: Multiple RFC 4462 GSSAPI authentication issues caused
  different behavior for valid and invalid accounts, incomplete
  MaxAuthTries enforcement, and a moderate pre-authentication resource
  denial of service. Fixed by aligning failure handling, applying attempt
  limits consistently, and adding missing error logging.
  Upstream: https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192

- CVE-2026-60001: GSSAPI and keyboard-interactive authentication paths
  did not always enforce the minimum per-attempt delay. Fixed by applying
  the delay consistently to the affected authentication failures.
  Upstream: https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454

- CVE-2026-60002: Several pieces of client state had incorrect ownership
  or lifetime, including a cached host key that could be freed too early
  and subsequently used. Fixed by retaining connection-scoped state for
  the full lifetime of the connection.
  Upstream: https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23

Each fix is kept in a separate commit for independent review and CVE
tracking. The OpenSSH recipe applies the patches in series order.

Validation:
- Built openssh successfully after applying the full series.
- Built core-image-minimal successfully with ptest packages enabled.

Devansh Patel (8):
  openssh: Fix CVE-2026-59999
  openssh: Fix CVE-2026-59997
  openssh: Fix CVE-2026-59998
  openssh: Fix CVE-2026-59996
  openssh: Fix CVE-2026-59995
  openssh: Fix CVE-2026-60001
  openssh: Fix CVE-2026-60002
  openssh: Fix CVE-2026-60000

 .../openssh/openssh/CVE-2026-59995.patch      |  42 ++++
 .../openssh/openssh/CVE-2026-59996.patch      |  37 +++
 .../openssh/openssh/CVE-2026-59997.patch      |  58 +++++
 .../openssh/openssh/CVE-2026-59998.patch      |  34 +++
 .../openssh/openssh/CVE-2026-59999.patch      |  36 +++
 .../openssh/openssh/CVE-2026-60000.patch      | 140 +++++++++++
 .../openssh/openssh/CVE-2026-60001.patch      | 130 ++++++++++
 .../openssh/openssh/CVE-2026-60002.patch      | 226 ++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |   8 +
 9 files changed, 711 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch