diff mbox series

[scarthgap,3/8] openssh: Fix CVE-2026-106584

Message ID 20261105053148.2704106-3-hthakar@cisco.com
State New
Headers show
Series [scarthgap,1/8] openssh: Fix CVE-2026-106586 | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 5:31 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream OpenSSH 10.6p1 backport for
CVE-2026-106584. The fix is referenced in [1] and the advisory in [2].

[1] https://github.com/openssh/openssh-portable/commit/aef20dfe30e68a469911a229b9117e7134766311
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-106584

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../openssh/openssh/CVE-2026-106584.patch     | 39 +++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |  1 +
 2 files changed, 40 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch
new file mode 100644
index 0000000000..69840fe880
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch
@@ -0,0 +1,39 @@ 
+From aef20dfe30e68a469911a229b9117e7134766311 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Tue, 15 Sep 2026 08:31:46 +0000
+Subject: [PATCH] upstream: Correct handling of DST when converting dates
+
+Timestamps conversion was ignoring Daylight Savings Time (DST) causing
+date conversions to be +/-1 hour under some circumstances.
+
+bz4004; from Khush Patel, ok deraadt
+
+OpenBSD-Commit-ID: bd5eb2603c04d4b5072b0e593b137a98ef75b731
+
+CVE: CVE-2026-106584
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/aef20dfe30e68a469911a229b9117e7134766311]
+
+Backport Changes:
+- Omitted the upstream OpenBSD RCS revision-only hunk and retained the
+  OpenSSH 9.6p1 revision identifier.
+- Kept the 9.6p1 mktime error check; this version has no tm_wday
+  sentinel. The added tm_isdst assignment is unchanged.
+
+(cherry picked from commit aef20dfe30e68a469911a229b9117e7134766311)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ misc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/misc.c b/misc.c
+index cac246b..55906d4 100644
+--- a/misc.c
++++ b/misc.c
+@@ -2476,6 +2476,7 @@ parse_absolute_time(const char *s, uint64_t *tp)
+ 		if ((tt = timegm(&tm)) < 0)
+ 			return SSH_ERR_INVALID_FORMAT;
+ 	} else {
++		tm.tm_isdst = -1;	/* mktime decides DST */
+ 		if ((tt = mktime(&tm)) < 0)
+ 			return SSH_ERR_INVALID_FORMAT;
+ 	}
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 1e00522d16..5fe975180e 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -48,6 +48,7 @@  SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            file://CVE-2026-106586_p2.patch \
            file://CVE-2026-106586_p3.patch \
            file://CVE-2026-106585.patch \
+           file://CVE-2026-106584.patch \
            file://CVE-2026-73283.patch \
            file://CVE-2026-73282.patch \
            file://CVE-2026-73281.patch \