[wrynose,18/36] openssh: set status for CVE-2026-59998

Message ID	5bdde909a864cb73f795224ee5f06c5c89dab85b.1785190123.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 18/36] openssh: set status for CVE-2026-59998 Date: Tue, 28 Jul 2026 00:55:32 +0200 Message-ID: <5bdde909a864cb73f795224ee5f06c5c89dab85b.1785190123.git.yoann.congal@smile.fr> In-Reply-To: <cover.1785190123.git.yoann.congal@smile.fr> References: <cover.1785190123.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[wrynose,01/36] curl: fix CVE-2026-7168 \| expand [wrynose,01/36] curl: fix CVE-2026-7168 [wrynose,02/36] gawk: Fix CVE-2026-40467 [wrynose,03/36] gawk: Fix CVE-2026-40468 [wrynose,04/36] gawk: Fix CVE-2026-40469 [wrynose,05/36] gawk: Fix CVE-2026-40553 [wrynose,06/36] rsync: Fix CVE-2026-29518 [wrynose,07/36] rsync: Fix CVE-2026-43619 [wrynose,08/36] rsync: Fix CVE-2026-43618 [wrynose,09/36] rsync: Fix CVE-2026-43620 [wrynose,10/36] rsync: Fix CVE-2026-43617 [wrynose,11/36] rsync: Fix CVE-2026-45232 [wrynose,12/36] gnutls: fix CVE-2026-3833 [wrynose,13/36] libpng: set status for CVE-2026-40930 [wrynose,14/36] python3-cryptography: set CVE_PRODUCT [wrynose,15/36] python3-ply: set CVE_PRODUCT [wrynose,16/36] python3-pyasn1: set CVE_PRODUCT [wrynose,17/36] python3-setuptools: Fix CVE-2026-59890 [wrynose,18/36] openssh: set status for CVE-2026-59998 [wrynose,19/36] libgcrypt: fix CVE-2026-41989 [wrynose,20/36] libgcrypt: fix CVE-2026-41990 [wrynose,21/36] sqlite3: fix CVE-2026-11822 and CVE-2026-11824 [wrynose,22/36] curl: add annotation for CVE-2026-10536 [wrynose,23/36] package.bbclass: hardcode emit_pkgdata to run last [wrynose,24/36] systemd-systemctl-native: disable libpam meson option [wrynose,25/36] util-linux: upgrade 2.41.3 -> 2.41.5 [wrynose,26/36] linux-yocto/6.18: update to v6.18.36 [wrynose,27/36] linux-yocto/6.18: update to v6.18.38 [wrynose,28/36] linux-yocto/6.18: update to v6.18.39 [wrynose,29/36] linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug f… [wrynose,30/36] xmlto: correct srcrev to point to released version [wrynose,31/36] vim: Security Fix for CVE-2026-42307 [wrynose,32/36] vim: Security Fix for CVE-2026-43961 [wrynose,33/36] vim: Security Fix for CVE-2026-47162 [wrynose,34/36] vim: Security Fix for CVE-2026-47167 [wrynose,35/36] vim: Security Fix for CVE-2026-55892 [wrynose,36/36] vim: Security Fix for CVE-2026-57452

Message ID

5bdde909a864cb73f795224ee5f06c5c89dab85b.1785190123.git.yoann.congal@smile.fr

State

New

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][wrynose 18/36] openssh: set status for CVE-2026-59998
Date: Tue, 28 Jul 2026 00:55:32 +0200
Message-ID: 
 <5bdde909a864cb73f795224ee5f06c5c89dab85b.1785190123.git.yoann.congal@smile.fr>
In-Reply-To: <cover.1785190123.git.yoann.congal@smile.fr>
References: <cover.1785190123.git.yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[wrynose,01/36] curl: fix CVE-2026-7168 | expand

Commit Message

Yoann Congal July 27, 2026, 10:55 p.m. UTC

From: Devansh Patel <devanshp@cisco.com>

Analysis:
- CVE-2026-59998 concerns an undocumented limitation of
  GSSAPIStrictAcceptorCheck in Windows Active Directory environments [1].
- Upstream OpenSSH 10.4 only documents the existing behavior and provides no
  code remediation [2].
- The recipe disables Kerberos/GSSAPI by default. Mark the CVE
  not-applicable-config when PACKAGECONFIG lacks kerberos, and unpatched when
  kerberos is enabled.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
[2] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432

Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: See previous version of this patch for context about ignoring vs
this CVE vs patching:
https://patchwork.yoctoproject.org/project/oe-core/patch/20260720175518.3546447-3-devanshp@cisco.com/#40497 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index f5184b1fce3..b13488e2652 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -44,6 +44,7 @@  Red Hat Enterprise Linux 7 and when running in a Kerberos environment"
 CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries."
 CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1."
 CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh."
+CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}"
 
 PAM_SRC_URI = "file://sshd"

[wrynose,18/36] openssh: set status for CVE-2026-59998

Commit Message

Patch