diff mbox series

[wrynose,v2] openssh: set status for CVE-2026-59998

Message ID 20260723090704.1625527-1-devanshp@cisco.com
State New
Headers show
Series [wrynose,v2] openssh: set status for CVE-2026-59998 | expand

Commit Message

Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) July 23, 2026, 9:07 a.m. UTC 
From: Devansh Patel <devanshp@cisco.com>

Analysis:
- CVE-2026-59998 concerns an undocumented limitation of
  GSSAPIStrictAcceptorCheck in Windows Active Directory environments [1].
- Upstream OpenSSH 10.4 only documents the existing behavior and provides no
  code remediation [2].
- The recipe disables Kerberos/GSSAPI by default. Mark the CVE
  not-applicable-config when PACKAGECONFIG lacks kerberos, and unpatched when
  kerberos is enabled.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
[2] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
Changes in v2:
- Drop the documentation-only backport for CVE-2026-59998.
- Add a configuration-aware CVE_STATUS that reports unpatched when Kerberos
  support is enabled and not-applicable-config otherwise.

 meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index f5184b1fce..b13488e265 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -44,6 +44,7 @@  Red Hat Enterprise Linux 7 and when running in a Kerberos environment"
 CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries."
 CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1."
 CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh."
+CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}"
 
 PAM_SRC_URI = "file://sshd"