[scarthgap,19/19] openssh: set status for CVE-2026-59998

Message ID	543550522f831479f07d332a40ba343c53ae1065.1785277157.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 19/19] openssh: set status for CVE-2026-59998 Date: Wed, 29 Jul 2026 00:21:54 +0200 Message-ID: <543550522f831479f07d332a40ba343c53ae1065.1785277157.git.yoann.congal@smile.fr> In-Reply-To: <cover.1785277157.git.yoann.congal@smile.fr> References: <cover.1785277157.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/19] libsolv: Fix CVE-2026-9149 \| expand [scarthgap,01/19] libsolv: Fix CVE-2026-9149 [scarthgap,02/19] package.bbclass: hardcode emit_pkgdata to run last [scarthgap,03/19] gawk: Fix CVE-2026-40467 [scarthgap,04/19] gawk: Fix CVE-2026-40468 [scarthgap,05/19] gawk: Fix CVE-2026-40469 [scarthgap,06/19] gawk: Fix CVE-2026-40553 [scarthgap,07/19] python3-cryptography: set CVE_PRODUCT [scarthgap,08/19] python3-ply: set CVE_PRODUCT [scarthgap,09/19] python3-pyasn1: set CVE_PRODUCT [scarthgap,10/19] python3-setuptools: Fix CVE-2026-59890 [scarthgap,11/19] vim: Security Fix for CVE-2026-28422 [scarthgap,12/19] vim: Security Fix for CVE-2026-42307 [scarthgap,13/19] vim: Security Fix for CVE-2026-43961 [scarthgap,14/19] vim: Security Fix for CVE-2026-47162 [scarthgap,15/19] vim: Security Fix for CVE-2026-47167 [scarthgap,16/19] sqlite3: fix CVE-2026-11822 and CVE-2026-11824 [scarthgap,17/19] curl: add annotation for CVE-2026-10536 [scarthgap,18/19] cargo-update-recipe-crates: Don't fail for partially empty Cargo.lock [scarthgap,19/19] openssh: set status for CVE-2026-59998

Message ID

543550522f831479f07d332a40ba343c53ae1065.1785277157.git.yoann.congal@smile.fr

State

New

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 19/19] openssh: set status for CVE-2026-59998
Date: Wed, 29 Jul 2026 00:21:54 +0200
Message-ID: 
 <543550522f831479f07d332a40ba343c53ae1065.1785277157.git.yoann.congal@smile.fr>
In-Reply-To: <cover.1785277157.git.yoann.congal@smile.fr>
References: <cover.1785277157.git.yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/19] libsolv: Fix CVE-2026-9149 | expand

Commit Message

Yoann Congal July 28, 2026, 10:21 p.m. UTC

From: Devansh Patel <devanshp@cisco.com>

Analysis:
- CVE-2026-59998 concerns an undocumented limitation of
  GSSAPIStrictAcceptorCheck in Windows Active Directory
  environments [1].
- Upstream OpenSSH 10.4 only documents the existing behavior and
  provides no code remediation [2].
- The recipe disables Kerberos/GSSAPI by default. Mark the CVE
  not-applicable-config when PACKAGECONFIG lacks kerberos, and
  unpatched when kerberos is enabled.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
[2] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432

Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: See previous version of this patch for context about ignoring vs
this CVE vs patching:
https://patchwork.yoctoproject.org/project/oe-core/patch/20260720175518.3546447-3-devanshp@cisco.com/#40497 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-connectivity/openssh/openssh_9.6p1.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index ba8aaad9bbb..b48e262c725 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -57,6 +57,7 @@  Red Hat Enterprise Linux 7 and when running in a Kerberos environment"
 CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries."
 CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1."
 CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh."
+CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}"
 
 PAM_SRC_URI = "file://sshd"

[scarthgap,19/19] openssh: set status for CVE-2026-59998

Commit Message

Patch