diff mbox series

[scarthgap,1/1] openssh: fix CVE-2026-106587

Message ID 20261016035448.3083867-2-hthakar@cisco.com
State New
Headers show
Series openssh: Security Fix | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:54 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1]..

[1] https://github.com/openssh/openssh-portable/commit/526fd2771342f36142099bec82c49ce0457c5016
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-106587

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../openssh/openssh/CVE-2026-106587.patch     | 76 +++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |  1 +
 2 files changed, 77 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch
new file mode 100644
index 0000000000..53c42dce1a
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch
@@ -0,0 +1,76 @@ 
+From 526fd2771342f36142099bec82c49ce0457c5016 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:35:09 +0000
+Subject: [PATCH] upstream: Correctly handle some options that accept "none"
+
+Some options, including AuthorizedPrincipalsFile were documented as accepting
+"none" as a way to disable them, however when overriddes by a ssh_config(5)
+Match keyword, this argument was being interpreted as a literal file.
+
+With Chris Rohlf in collaboration with Claude and Anthropic Research
+
+ok markus, deraadt
+
+OpenBSD-Commit-ID: 802f3a7695eba20924c05e500b0ecd34ec877756
+
+CVE: CVE-2026-106587
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/526fd2771342f36142099bec82c49ce0457c5016]
+
+Backport Changes:
+- Retained the OpenSSH 9.6p1 OpenBSD revision identifier in servconf.c.
+- Kept the 9.6p1 M_CP_STROPT calls for post-authentication options; the
+  upstream copy_server_option_string helper does not exist in this version.
+
+(cherry picked from commit 526fd2771342f36142099bec82c49ce0457c5016)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ servconf.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+--- a/servconf.c
++++ b/servconf.c
+@@ -2791,6 +2791,22 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+ 	/* Arguments that accept '+...' need to be expanded */
+ 	assemble_algorithms(dst);
+ 
++	/*
++	 * These options may be "none" to clear a global setting.  They are
++	 * consulted before authentication, so they must be cleared here
++	 * rather than in the post-auth section below.
++	 */
++#define CLEAR_ON_NONE(v) \
++	do { \
++		if (option_clear_or_none(v)) { \
++			free(v); \
++			v = NULL; \
++		} \
++	} while(0)
++	CLEAR_ON_NONE(dst->authorized_principals_file);
++	CLEAR_ON_NONE(dst->trusted_user_ca_keys);
++	CLEAR_ON_NONE(dst->banner);
++
+ 	/*
+ 	 * The only things that should be below this point are string options
+ 	 * which are only used after authentication.
+@@ -2800,15 +2816,10 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+ 
+ 	/* These options may be "none" to clear a global setting */
+ 	M_CP_STROPT(adm_forced_command);
+-	if (option_clear_or_none(dst->adm_forced_command)) {
+-		free(dst->adm_forced_command);
+-		dst->adm_forced_command = NULL;
+-	}
+ 	M_CP_STROPT(chroot_directory);
+-	if (option_clear_or_none(dst->chroot_directory)) {
+-		free(dst->chroot_directory);
+-		dst->chroot_directory = NULL;
+-	}
++	CLEAR_ON_NONE(dst->chroot_directory);
++	CLEAR_ON_NONE(dst->adm_forced_command);
++#undef CLEAR_ON_NONE
+ 
+ 	/* Subsystems require merging. */
+ 	servconf_merge_subsystems(dst, src);
+-- 
+2.43.0
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 572a614380..d71e3d3d87 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -47,6 +47,7 @@  SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            file://CVE-2026-73283.patch \
            file://CVE-2026-73282.patch \
            file://CVE-2026-73281.patch \
+           file://CVE-2026-106587.patch \
            "
 SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"