diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch new file mode 100644 index 0000000000..a694424cf4 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch @@ -0,0 +1,39 @@ +From 991f1f31dde2797416acaf4319dbebe764446c6f Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:33:44 +0000 +Subject: [PATCH] upstream: Propagate authorized_keys "resrict" keyword + +The "restrict" keyword was not pervasively being applied to TunnelForwarding +connections (which are administratively disabled by default). This is a +separate problem to the one fixed in openssh-10.5 + +reported by several people; ok markus, deraadt + +OpenBSD-Commit-ID: 8c36c31dc2bdbc0c432d1056496b2f1ce93198d1 + +CVE: CVE-2026-106586 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk and retained the + Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit 991f1f31dde2797416acaf4319dbebe764446c6f) +Signed-off-by: Hetvi Thakar +--- + auth-options.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/auth-options.c b/auth-options.c +--- a/auth-options.c ++++ b/auth-options.c +@@ -604,6 +604,7 @@ sshauthopt_merge(const struct sshauthopt *primary, + OPTFLAG_AND(no_require_user_presence); + /* Restrictive flags are logical-OR (i.e. must be set in either) */ + OPTFLAG_OR(require_verify); ++ OPTFLAG_OR(restricted); + #undef OPTFLAG_AND + + /* Earliest expiry time should win */ +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch new file mode 100644 index 0000000000..10a2abe497 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch @@ -0,0 +1,101 @@ +From ded92bffa2e2f2db9b83245c5061812791bfa47f Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 04:51:28 +0000 +Subject: [PATCH] upstream: correctly check sshauthopt->restricted merging + +OpenBSD-Regress-ID: e81e9267514338d6cf6bd2f83dcb722538af528e + +CVE: CVE-2026-106586 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/ded92bffa2e2f2db9b83245c5061812791bfa47f] + +Backport Changes: +- Omitted the upstream tests.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit ded92bffa2e2f2db9b83245c5061812791bfa47f) +Signed-off-by: Hetvi Thakar +--- + regress/unittests/authopt/tests.c | 41 +++++++++++++++++++++-------------------- + 1 file changed, 21 insertions(+), 20 deletions(-) + +diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c +--- a/regress/unittests/authopt/tests.c ++++ b/regress/unittests/authopt/tests.c +@@ -418,13 +418,14 @@ test_merge(void) + } while (0) + + /* Check a single case of merging of flag options */ +-#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, var, val) \ ++#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, \ ++ rflag, var, val) \ + do { \ + PREPARE(keybase " " label, keyname, keywords); \ +- expected = mostly_off ? \ +- sshauthopt_new() : default_authkey_opts(); \ +- expected->var = val; \ ++ expected = rflag ? default_authkey_restrict_opts() : \ ++ (mostly_off ? sshauthopt_new() : default_authkey_opts()); \ + ASSERT_PTR_NE(expected, NULL); \ ++ expected->var = val; \ + CHECK_SUCCESS_AND_CLEANUP(); \ + TEST_DONE(); \ + } while (0) +@@ -437,40 +438,40 @@ test_merge(void) + #define FLAG_TEST(keybase, keyword, var) \ + do { \ + FLAG_CASE(keybase, "keys:default,yes cert:default,no", \ +- "no_" keybase, keyword, 0, var, 0); \ ++ "no_" keybase, keyword, 0, 0, var, 0); \ + FLAG_CASE(keybase,"keys:-*,yes cert:default,no", \ +- "no_" keybase, "restrict," keyword, 1, var, 0); \ ++ "no_" keybase, "restrict," keyword, 1, 1, var, 0); \ + FLAG_CASE(keybase, "keys:default,no cert:default,no", \ +- "no_" keybase, "no-" keyword, 0, var, 0); \ ++ "no_" keybase, "no-" keyword, 0, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:default,no", \ +- "no_" keybase, "restrict,no-" keyword, 1, var, 0); \ ++ "no_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \ + \ + FLAG_CASE(keybase, "keys:default,yes cert:-*,yes", \ +- "only_" keybase, keyword, 1, var, 1); \ ++ "only_" keybase, keyword, 1, 0, var, 1); \ + FLAG_CASE(keybase,"keys:-*,yes cert:-*,yes", \ +- "only_" keybase, "restrict," keyword, 1, var, 1); \ ++ "only_" keybase, "restrict," keyword, 1, 1, var, 1); \ + FLAG_CASE(keybase, "keys:default,no cert:-*,yes", \ +- "only_" keybase, "no-" keyword, 1, var, 0); \ ++ "only_" keybase, "no-" keyword, 1, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:-*,yes", \ +- "only_" keybase, "restrict,no-" keyword, 1, var, 0); \ ++ "only_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \ + \ + FLAG_CASE(keybase, "keys:default,yes cert:-*", \ +- "no_permit", keyword, 1, var, 0); \ ++ "no_permit", keyword, 1, 0, var, 0); \ + FLAG_CASE(keybase,"keys:-*,yes cert:-*", \ +- "no_permit", "restrict," keyword, 1, var, 0); \ ++ "no_permit", "restrict," keyword, 1, 1, var, 0); \ + FLAG_CASE(keybase, "keys:default,no cert:-*", \ +- "no_permit", "no-" keyword, 1, var, 0); \ ++ "no_permit", "no-" keyword, 1, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:-*", \ +- "no_permit", "restrict,no-" keyword, 1, var, 0); \ ++ "no_permit", "restrict,no-" keyword, 1, 1, var, 0); \ + \ + FLAG_CASE(keybase, "keys:default,yes cert:*", \ +- "all_permit", keyword, 0, var, 1); \ ++ "all_permit", keyword, 0, 0, var, 1); \ + FLAG_CASE(keybase,"keys:-*,yes cert:*", \ +- "all_permit", "restrict," keyword, 1, var, 1); \ ++ "all_permit", "restrict," keyword, 1, 1, var, 1); \ + FLAG_CASE(keybase, "keys:default,no cert:*", \ +- "all_permit", "no-" keyword, 0, var, 0); \ ++ "all_permit", "no-" keyword, 0, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:*", \ +- "all_permit", "restrict,no-" keyword, 1, var, 0); \ ++ "all_permit", "restrict,no-" keyword, 1, 1, var, 0); \ + \ + } while (0) + FLAG_TEST("portfwd", "port-forwarding", permit_port_forwarding_flag); +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch new file mode 100644 index 0000000000..6defa83ec6 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch @@ -0,0 +1,39 @@ +From a30bafcbbd44dc4dc91916240c32ecabff899338 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 04:56:12 +0000 +Subject: [PATCH] upstream: simpler + +OpenBSD-Regress-ID: c7f30b865abd0b3e0e5514f861509c32e352a760 + +CVE: CVE-2026-106586 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a30bafcbbd44dc4dc91916240c32ecabff899338] + +Backport Changes: +- Omitted the upstream tests.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit a30bafcbbd44dc4dc91916240c32ecabff899338) +Signed-off-by: Hetvi Thakar +--- + regress/unittests/authopt/tests.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c +--- a/regress/unittests/authopt/tests.c ++++ b/regress/unittests/authopt/tests.c +@@ -422,10 +422,11 @@ test_merge(void) + rflag, var, val) \ + do { \ + PREPARE(keybase " " label, keyname, keywords); \ +- expected = rflag ? default_authkey_restrict_opts() : \ +- (mostly_off ? sshauthopt_new() : default_authkey_opts()); \ ++ expected = mostly_off ? \ ++ sshauthopt_new() : default_authkey_opts(); \ + ASSERT_PTR_NE(expected, NULL); \ ++ expected->restricted = rflag; \ + expected->var = val; \ + CHECK_SUCCESS_AND_CLEANUP(); \ + TEST_DONE(); \ + } while (0) +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index aceaa6420f..7760dae931 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -35,6 +35,9 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-73282.patch \ file://CVE-2026-73281.patch \ file://CVE-2026-106584.patch \ + file://CVE-2026-106586_p1.patch \ + file://CVE-2026-106586_p2.patch \ + file://CVE-2026-106586_p3.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"