From patchwork Mon Jul 20 17:55:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92939 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E3DAC44532 for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3615.1784570226377132936 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=iNPbBIDb; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3053; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=NVk6BTlbcX/IAKxULjQKZ7HaZPD6o89b+ZogtpPMB+I=; b=iNPbBIDbBdTulwU4+bWED2sFAygrVhQS3Y3Gae0Jd2+K29GMOD5dakUT MGWeRHAdsKGEm5lfCsYVmvi5+PpZYMAq9ubh6QZFE3RUP7FIu21xeyyvg rHjM8U7vLjUcmirSv7Jipx2SK9OdAw9N48dYWL1wiK3Qm9Em+2GfSb2PM 68eMZCVdZLHE0Zpc/RGg2D8rJwxY8fYLoM0YBrTHDCrLVWSjYp0n0fpgK R9hOmRR+jmio3GtUZiuqiE+0SOBNbEPhbMgFhqlE18ySsY9ak0Lu2RACs Ozktoo98FAmVfydBhN5qBmFYPl3WDwhYWfVAlfCoMpp5vok3jxxIWm7Eb A==; X-CSE-ConnectionGUID: 9QU+3/seQM6kJ6AKRRLySw== X-CSE-MsgGUID: GE+IWk2WQxeS/8PBp3YNSw== X-IPAS-Result: A0BFAgA1YF5q/5L/Ja1aglmCV3RfQkmWSp4egX4PAQEBD0QNBAEBhD9GjVUCJjQJDgECBAMCAwEBAQEBAQEBAQEBCwEBBQEBAQIBBwWBDhOGTw2GWgECATUBGAEbEiwDAQJaIyGDAgGCdAIBEbt4giyBAYMoAT8CQ1DbLgELFAEFgTOFP4ggXBgBhHwnGxuBcoEVg2mBBYFcAgIBF4ENIYZdBIIiehKBWh6PdEiBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBDBsHBYEdgTqBAoR0Ix8DOX+BL3VKdy1pARIXgSaCEgKBOwIOAwsYDUgRLDcUGQQ+bgeNQCOCPwGBDgErgiyTcJIGgTWfWgoog3WMIZU6GjOqbAuYfY4KllCEaYFoPIFZcBWDIglKGQ+OOINrhRPJRyQ1CzIBAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:/MAifKKVwfuRBlhnFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS0GNUz zZJUGvVOfzcN2ekfd9+Oomw9k5Tu5bXxtUxQAEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZsCCSa/kvxWlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnQ0 T/Oi5eHYgH9hGQsajx8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN0/NXx1ZsoD999SX2Jsq 9U7Egopfyuc0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBXLAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEqojx5nYj/7DLoykfmhgGL/axVTqUmeouw85G27IAlZjeG3YYCOJITQLSlTtmm15 UP5/D7GOwEXD5vP8RCdqUOKvfCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PK+kEOWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRu1ffDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9ExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:D2TrIqCMIYdjYqPlHemA55DYdb4zR+YMi2TDGXofdfUzSL38qy nAppUmPHPP5Qr5O0tQ++xoRpPhfZq0z/cciuMs1NyZMjUO1lHFEGhK1/qH/9SZIVycysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:1Y8rIWM1t5KIPe5DCRBatxVTAc0cVyPe7in5AHWCLXdSV+jA X-Talos-MUID: 9a23:UIxIKgZl8b/v9OBTmBKvpQ5hbvhR86mVTxA1u41diu+/Knkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512923602" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 5A50718000497; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id EE4DDCEC30E; Mon, 20 Jul 2026 10:57:04 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 1/8] openssh: Fix CVE-2026-59999 Date: Mon, 20 Jul 2026 10:55:11 -0700 Message-Id: <20260720175518.3546447-1-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241468 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-59999. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753 [2] https://www.cve.org/CVERecord?id=CVE-2026-59999 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59999.patch | 38 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch new file mode 100644 index 0000000000..5907a991b9 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch @@ -0,0 +1,38 @@ +From a83dd105dc407d95c42140ea6f04a1e247aaf2f9 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 31 May 2026 04:47:29 +0000 +Subject: [PATCH] upstream: DisableForwarding=yes didn't override + PermitTunnel=yes + +Reported independently by Huzaifa Sidhpurwala of Redhat and Marko +Jevtic; ok markus@ + +OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c + +CVE: CVE-2026-59999 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk in serverloop.c and + retained the Wrynose OpenSSH 10.3p1 revision because this stable + backport carries only the functional security change. + +(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753) +Signed-off-by: Devansh Patel +--- + serverloop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/serverloop.c b/serverloop.c +index 8e63480ec..42c3ce9fe 100644 +--- a/serverloop.c ++++ b/serverloop.c +@@ -523,7 +523,7 @@ server_request_tun(struct ssh *ssh) + ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); + return NULL; + } +- if ((options.permit_tun & mode) == 0) { ++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) { + ssh_packet_send_debug(ssh, "Server has rejected tunnel device " + "forwarding"); + return NULL; diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index a050475532..2c3b839442 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -24,6 +24,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://run-ptest \ file://sshd_check_keys \ file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ + file://CVE-2026-59999.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92937 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C28EC4452F for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3657.1784570226506229953 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=YJPF7e3M; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3683; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=UZgrcunvlJuojD7vSuX1prOrrj3/VbZv5eh0lC69Azk=; b=YJPF7e3Mk4c+k9s0ymojbkOFYlVDaFnV9OcQ6OuBQpPBpNnCHslfUcZq il1cUwNVTDQ2hd9sxZdjs/oG05oZ/ZMpaaKx5FZGXWJSDnRC6+HcysHYs EHbcUKO+tllvyf94Kwb0vm1i/RcTJQ97Sygkcqq9YdVBylX4IKPNa+xCY IgKaBXxknf4QvANl2uheysJ9RzlpNyXlO15/jZsnkwnN/6ZsrUxRCxwly 7xwfpJ7Gcmp/FLfg1tSiCLpnvw0rllLvdwxXXgiVFG9QAKNuJteXBhXQu WLUUq9mYTOngTbqhVylVbLFIoBv94nao2DfznzeBKdZw35zJQrenZFBdO w==; X-CSE-ConnectionGUID: YF+wAkdQTwetCuIuF7tMXg== X-CSE-MsgGUID: rjrt8K08Rvq+/EI6DKUBkw== X-IPAS-Result: A0BIAgCzYF5q/5P/Ja1aglmCV3RfQkmWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNUwImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAycLARgBGxIQHAMBAi8rIwgZgwIBgnQCARG7fIF5M4EBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FygRWDaYEFgVwCAgEXgS6GXQSCInoSgVoej3RIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCDgMLGA1IESw3FBkEPm4HjUAjgj8BexMBK4EggQwOpWihDwoog3WMIZU6GjOqbAuYfY4KllCEaYFoPIFZcBWDIglKGQ+OOINrhRPJRyQ1CzIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:0KQXV6/WHfRFuFsgEi8MDrUD0X+TJUtcMsCJ2f8bNWPcYEJGY0x3z GdOCzyFOquDZDCmLY11YYm28RwAup6Am9JjTwU5rX1EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmE4EzrauS9xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mvyyHjEAX9gWAsbThMs/zrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kHE84H0+V7OF1R+ OAzNREQQE+fotK5lefTpulE3qzPLeHxN48Z/3UlxjbDALN/GdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0In1lQ/UPrSmM+ki2f2dSZYsHqepLE85C7YywkZPL3FbYOPIIbbHJsN9qqej njE5XipIUlKDsKGin2o0yyApdLlnjyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0W5Qd93L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXzBCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1rN94cRva1fApEFI/ IronPort-HdrOrdr: A9a23:AZ6OI6k2kYGS/lyv6g7yDUeL1DvpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:Vwo8Y28piieDaP8bN7aVv386Wd8McXHk8GjdP2SlKHtHF6GweVDFrQ== X-Talos-MUID: 9a23:RheC4AXitdEueqfq/CXuni0yF5842bq3SwcgsMsqmPSuNjMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512229160" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id 5B40018000247; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id F1C79CEC313; Mon, 20 Jul 2026 10:57:04 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 2/8] openssh: Fix CVE-2026-59997 Date: Mon, 20 Jul 2026 10:55:12 -0700 Message-Id: <20260720175518.3546447-2-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241470 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-59997. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014 [2] https://www.cve.org/CVERecord?id=CVE-2026-59997 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59997.patch | 60 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch new file mode 100644 index 0000000000..7d77fbcc9e --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch @@ -0,0 +1,60 @@ +From 91ce99061c78d0ae84dafc96409c8ea9746f70c0 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Fri, 5 Jun 2026 08:53:07 +0000 +Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp + server, + +previously they were silently dropped; reported by Steve Caffrey ok deraadt@ + +OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624 + +CVE: CVE-2026-59997 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk in session.c and + retained the Wrynose OpenSSH 10.3p1 revision because this stable + backport carries only the functional security change. + +(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014) +Signed-off-by: Devansh Patel +--- + session.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/session.c b/session.c +index 93de35d7c..b1f125a3c 100644 +--- a/session.c ++++ b/session.c +@@ -1607,21 +1607,22 @@ do_child(struct ssh *ssh, Session *s, const char *command) + exit(1); + } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) { + extern int optind, optreset; +- int i; +- char *p, *args; ++ int sftp_argc; ++ char **sftp_argv; + + setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME); +- args = xstrdup(command ? command : "sftp-server"); +- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " "))) +- if (i < ARGV_MAX - 1) +- argv[i++] = p; +- argv[i] = NULL; ++ if (argv_split(command == NULL ? "sftp-server" : command, ++ &sftp_argc, &sftp_argv, 1) != 0) { ++ error("internal error: can't split internal-sftp " ++ "arguments"); ++ exit(1); ++ } + optind = optreset = 1; +- __progname = argv[0]; ++ __progname = sftp_argv[0]; + #ifdef WITH_SELINUX + ssh_selinux_change_context("sftpd_t"); + #endif +- exit(sftp_server_main(i, argv, s->pw)); ++ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw)); + } + + fflush(NULL); diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 2c3b839442..87bd417b2d 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -25,6 +25,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://sshd_check_keys \ file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ file://CVE-2026-59999.patch \ + file://CVE-2026-59997.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92932 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08DA0C44520 for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3657.1784570226506229953 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IGFFdCmK; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3048; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=r86+/VG8cUZMsplC3s+SmD0k+D3GQbtkz8s1Bts+7lc=; b=IGFFdCmK1R1ZTX7PSSW+PVZqibUWJ5o9p24se1acM5erxpN5wSY6FKZ1 Rl01Nh0zgspUIDZXAkdHLE5ds7q/BPgamvqFtYjCYjC0BhR5V0ich+Pcg 9q3ieqv7+eN9sT8Gjk9qe1wPCI8hjsKlD6nDItz1ZfWahkAtmRQaB8sh6 +faVtLiDFpEYk90H8EuZiR3y7p8j2eSVMYkYyAmg1iDGR5k2zGKqx18R9 zTOqSXWjRI+S8NXfPTY/JqVB0b4yzGEcaLZgODryVaL/HwH8HuSaz/644 QVOlzD+XvI4UoD6jtsjhKh2BiXFnkZQXHmKsl+EvN//WpdhpJ0glCkplb w==; X-CSE-ConnectionGUID: yAyTH9YBSxSyz8JpQJaTFQ== X-CSE-MsgGUID: W7fF8+8GRkmm5VD73fqLhg== X-IPAS-Result: A0BIAgCzYF5q/5L/Ja1aglmCV3RfQkmWTZ4bgX4PAQEBD0QNBAEBhD9GAo1TAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDMgEYARsSEBwDAQIvKx0BBQgZgwIBgnQCARG7fIIsgQGDKAE/AkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKEfoEFgVwCAgEXiAsEgiJ6EoFaHoF9PY06SIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EMGwcFgR2BOoEChHQjHwM5f4EvdUp3LWkBEheBJoISAoE7Ag4DCxgNSBEsNxQZBD5uB41AI4JAaiQBK4IspXahDwoog3WMIZU6GjOqbAuYfY4KlTaBGoRpgWg8gVlwFTuCZwlKGQ+OOINrhRPJRyQ1CzIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:4HGDZqikINOtYIEicyDKTTb3X161MREKZh0ujC45NGQN5FlHY01je htvDD+Ea/zeYmL2Kdlxb4zkoE1XsMWHz9JiSQJv/C88RC9jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FH1dOOn9SUgvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeCULOZ82QsaDxMtPjb8E0HUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUJ0/dLITB/3 8cIEyEfPjKbvsC//JyCH7wEasQLdKEHPasFsX1miDWcBvE8TNWbEuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZgl/5JEWxI9EglHzfiNRrkmVvYI84nPYy0p6172F3N/9J4XQH58ExxjBz o7A11umDD9Kd4yw8zmA9y+SqrCUkzrfWI1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFm8HY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn2891te5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:U19jkqtCbxFJt3xYB5+d1kD+7skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:1pMHV2BlrNXgSo76EzhO5XI0S/EPSW3m3WWAAVeBK29VZoTAHA== X-Talos-MUID: 9a23:mOJvGgmkjKHzFwWJovpgdnpda8lGs+f+J3oOlJBbheXbbiJpHzeS2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512229161" Received: from rcdn-l-core-09.cisco.com ([173.37.255.146]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-09.cisco.com (Postfix) with ESMTPS id 61C0218000238; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id 00FCCCEC314; Mon, 20 Jul 2026 10:57:05 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 3/8] openssh: Fix CVE-2026-59998 Date: Mon, 20 Jul 2026 10:55:13 -0700 Message-Id: <20260720175518.3546447-3-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-09.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241475 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-59998. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432 [2] https://www.cve.org/CVERecord?id=CVE-2026-59998 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59998.patch | 36 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch new file mode 100644 index 0000000000..3e15fe19fa --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch @@ -0,0 +1,36 @@ +From 94a089cd331eeea77ffd6fd715e61d281c3b97c3 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 24 Jun 2026 06:55:12 +0000 +Subject: [PATCH] upstream: mention a caveat regarding + GSSAPIStrictAcceptorCheck in + +some environments + +OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2 + +CVE: CVE-2026-59998 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432] + +Backport Changes: +- Omitted the upstream OpenBSD revision and Mdocdate-only hunks in + sshd_config.5 and retained the Wrynose OpenSSH 10.3p1 values because + this stable backport carries only the security-relevant documentation. + +(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432) +Signed-off-by: Devansh Patel +--- + sshd_config.5 | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sshd_config.5 b/sshd_config.5 +index 3f5e29812..22b9039d2 100644 +--- a/sshd_config.5 ++++ b/sshd_config.5 +@@ -769,6 +769,7 @@ machine's default store. + This facility is provided to assist with operation on multi homed machines. + The default is + .Cm yes . ++This option may not be effective in Windows Active Directory environments. + .It Cm HostbasedAcceptedAlgorithms + Specifies the signature algorithms that will be accepted for hostbased + authentication as a list of comma-separated patterns. diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 87bd417b2d..b9f2a37c57 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -26,6 +26,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \ file://CVE-2026-59999.patch \ file://CVE-2026-59997.patch \ + file://CVE-2026-59998.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92935 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 419B4C4452E for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3656.1784570226468789114 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Hla+mVvP; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2937; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RjOn3myVC5qRzi8bqHDrE/tPbcPvcuayk/iZe6Cwcpo=; b=Hla+mVvPKwZ40Fa2qShdHT6qhoA6pLnR8SOAFPPR6m2hvIBWFZnoV6Sc x8gXrHuySHzys/ysKUIjCCS5IBPN47iERXgCPtJmglVUt9G1ZoUjVQvE4 CvwivfkV6iVZ7j35elVPalAOc49cG72NjeiF+acgA0WdnuJOCWBobuu7r y8/k/FeI7279WGYBZGPVlCPHCTpj5JpLacHImmA08oQRUSzWJqAsorEhe GBaonk4GQSZF9W1rtaDxhi0IxL6dvAHx+U+4WNu9vt6CsXBziGEGqp7Va 4hXbRV9KalMPG7n2O2STJNaEwgFAH8ut2RR9nS9Ry0QenNymOboXwEmtS w==; X-CSE-ConnectionGUID: tZY2UjupQ5yVOoMvlbj49Q== X-CSE-MsgGUID: AkFY2A0kTUqTW7pjZdgOcA== X-IPAS-Result: A0BHAgCzYF5q/43/Ja1aglmCV3RfQkmWTZ4bgX4PAQEBD0QNBAEBhD9GAo1TAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDMgEYARsSEBwDAQIvKyMIGYMCAYJ0AgERuysaN4IsgQGDKAE/AkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKECHaBBYFcAgIBF4IThXgEgiJ6EoFaHo90SIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EMGwcFgR2BOoEChHQjHwM5f4EvdUp3LWkBEheBJoISAoE7Ag4DCxgNSBEsNxQZBD5uB41AI4I/AYEOASuCLKV2oQ8KKIN1jCGVOhozqmwLmH2OCpZQhGmBaDyBWXAVgyIJShkPjjiDa4UTyUckNQsyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:QYSzEappKoWevp+olEUR4oNSBT1eBmJJZBIvgKrLsJaIsI4StFCzt garIBmCM/6LZ2H1ft9yaI2/pkpQsZLWmtJqTlRupHgzRSgSpePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOCn9j8kif3gqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgLNNwJcaDpOtfrc8ks34pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0vpFMDtz9 +EAEW0cUDeEovyyyrDnG9A506zPLOGzVG8ekmtrwTecCbMtRorOBv2Wo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LUfrSn8/w7pX7WzFVtluTvqovy2PS1wd2lrPqNbI5f/TXHJ8NwRvE+ zquE2LRKxI0BYa2kTm5z2uQubDXnxH3V6UZPejtnhJtqBjJroAJMzURTVa9rPyzh0KyVt4aI EsO9wIqrLMu7wqsVtT7UhiyrXKIsxJaXMBfe9DW8ymXwabSpgLcDW8eQ3sZNJottdQ9Qnoh0 Vrhc87VOAGDeYa9ERq1nop4ZxvrUcTJBQfuvRM5cDY= IronPort-HdrOrdr: A9a23:2ebQ66xeRfYuZ3UTkpIvKrPw9L1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICPcqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIWpIObuEYdWIK7vrS0U2fD8sqxsWB/eSDgOfTyGoocCRRApsQljuQzm2gYzZLrM4sP+tAKK ah X-Talos-CUID: 9a23:h0odH2nuWvJBPzgR3GyTt9Bt9UDXOWHv/S3tIVKgMDt4dpqSbEGU8qE4wvM7zg== X-Talos-MUID: 9a23:rhjs0QpQjEz8LbzBbM8ezxhhGvYyyvytNH0UrapZo8u2OSNXMB7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512075450" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 674A718000181; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id 058F3CEC315; Mon, 20 Jul 2026 10:57:05 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 4/8] openssh: Fix CVE-2026-59996 Date: Mon, 20 Jul 2026 10:55:14 -0700 Message-Id: <20260720175518.3546447-4-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241469 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-59996. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78 [2] https://www.cve.org/CVERecord?id=CVE-2026-59996 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59996.patch | 39 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch new file mode 100644 index 0000000000..9db9988690 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch @@ -0,0 +1,39 @@ +From f479595f7498e8c83d3df9d3eddb6e555497ff5b Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 28 Jun 2026 23:47:16 +0000 +Subject: [PATCH] upstream: resist that return ".." via remote glob during + +remote/remote copies, similar to fixes for bz3871 for remote/local copies. +From Swival scanner + +OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5 + +CVE: CVE-2026-59996 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk in scp.c and retained + the Wrynose OpenSSH 10.3p1 revision because this stable backport carries + only the functional security change. + +(cherry picked from commit 36480181fa22f98e180b4f9e10203480c0346c78) +Signed-off-by: Devansh Patel +--- + scp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scp.c b/scp.c +index 1faa9a555..bd01ebffd 100644 +--- a/scp.c ++++ b/scp.c +@@ -2039,6 +2039,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to, + goto out; + } + ++ /* Special handling for source of '..' */ ++ if (strcmp(filename, "..") == 0) ++ filename = "."; /* Download to dest, not dest/.. */ ++ + if (targetisdir) + abs_dst = sftp_path_append(target, filename); + else diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index b9f2a37c57..807e718ffb 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -27,6 +27,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-59999.patch \ file://CVE-2026-59997.patch \ file://CVE-2026-59998.patch \ + file://CVE-2026-59996.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92934 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56CCBC44530 for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3616.1784570226559015720 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=EldXLSwl; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3124; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=2+O6FIpodsKcUy1aZrB5prTR27v54ZYSm2MhXZzs33M=; b=EldXLSwleeVRTYNdKTl1/EIRiKSIaSd2xrH3vz+VLHzKY9jR4uMER//2 yf0k/NosLVI8b8Zvr6Hk1J1l9tuNCDIy1MyVuQW1p6TJsUXi7dqvFHbn2 qFg/HH6ITBl6d3KAaGNcR0DFBoGRpkrGdQQd6Soyb7166StHyOaE0eZHf cD5pgdgDWjxQ6WHDeTSQesAzgi+FoRBNXOKg0GgZnjOLRLZmHb0y1FNZm fa5L5GScBtq0p3zbbLXkRDxF1faHMOfLyZwNuUTZ0S296qMFBl5OLfFIo 95i1925Q3UGVue5BEGqx+JbApGxLKuO79AdOQsF0ST+yFEZi9SGnv3zxt g==; X-CSE-ConnectionGUID: NwljhpAfTr69o9MhJsVYgA== X-CSE-MsgGUID: lGNumj9ASNK9NhNn9d0A5Q== X-IPAS-Result: A0BIAgCzYF5q/5H/Ja1aglmCV3RfQkmWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNUwImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAzIBGAEbEhAcAwECLysjCBmDAgGCdAIBEbsrGjeCLIEBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FygRWDaYEFgVwCAgEXgS6GXQSCInoSgVoeUI8kSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EMGwcFgR2BOoEChHQjHwM5f4EvdUp3LWkBEheBJoISAoE7Ag4DCxgNSBEsNxQZBD5uB41AI4I/AYEOARMYgiyTEZJloQ8KKIN1jCGVOhozqmwLmH2OCpZQhGmBaDyBWXAVgyIJShkPjjiDa4UTyUckNQsyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:DY+3jKrFhxrXLY9bZ0FXH3h5kBleBmJJZBIvgKrLsJaIsI4StFCzt garIBmOPffYM2T1f9sjbo3noBlT6JXUx9VlTgNvqys2EHxE8ePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOCn9j8kif3gqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgLNNwJcaDpOtfrc8ks34pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0sBoBWNO7 dUWFCpTPxfSouKU24yKRcA506zPLOGzVG8ekmtrwTecCbMtRorOBv2ao9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LVfrSn8/w7pX7WzFVtluTvqovy2PS1wd2lrPqNbI5f/TXHJ8LxRnF+ z6uE2LRBj48KdmdmBO+1FH9oO/pm3L3AKtPLejtnhJtqBjJroAJMzURTVa9rPyzh0KyVt4aI EsO9wIqrLMu7wqsVtT7UhiyrXKIsxJaXMBfe9DW8ymXwabSpgLcDW8eQ3sZOJottdQ9Qnoh0 Vrhc87VOAGDeYa9ERq1nop4ZxvoUcTJBQfuvRM5cDY= IronPort-HdrOrdr: A9a23:ot/WfKGthVp/u7dKpLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:k393fW5ky1ZSAN6ggNss0lEQGMA9W3Ph1imBJB6dCURydoyaYArF X-Talos-MUID: 9a23:0E84nQk+wpXyFQ7Bm4BGdnpmG+F15qb/IXsrssQgu++CZCAoEmqk2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512637554" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id 78747180001D4; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id 0FEC7CEC316; Mon, 20 Jul 2026 10:57:05 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 5/8] openssh: Fix CVE-2026-59995 Date: Mon, 20 Jul 2026 10:55:15 -0700 Message-Id: <20260720175518.3546447-5-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241471 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-59995. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b [2] https://www.cve.org/CVERecord?id=CVE-2026-59995 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59995.patch | 44 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch new file mode 100644 index 0000000000..ac1712eec2 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch @@ -0,0 +1,44 @@ +From 02e4b3cfd0bef64381921cdb9d6a21b1f50fdb74 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 29 Jun 2026 01:47:21 +0000 +Subject: [PATCH] upstream: avoid download to server-controlled path when + performing + +download on the commandline. From Swival scanner + +OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f + +CVE: CVE-2026-59995 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk in sftp.c and retained + the Wrynose OpenSSH 10.3p1 revision because this stable backport carries + only the functional security change. + +(cherry picked from commit 1b39f39657d2e58f8ec57341581a39bbf0be645b) +Signed-off-by: Devansh Patel +--- + sftp.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/sftp.c b/sftp.c +index eebb166e8..33c8364e3 100644 +--- a/sftp.c ++++ b/sftp.c +@@ -2287,13 +2287,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2) + return (-1); + } + } else { +- /* XXX this is wrong wrt quoting */ +- snprintf(cmd, sizeof cmd, "get%s %s%s%s", +- global_aflag ? " -a" : "", dir, +- file2 == NULL ? "" : " ", +- file2 == NULL ? "" : file2); +- err = parse_dispatch_command(conn, cmd, +- &remote_path, startdir, 1, 0); ++ err = process_get(conn, dir, file2, remote_path, 0, 0, ++ global_aflag, 0); + free(dir); + free(startdir); + free(remote_path); diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 807e718ffb..4aa81214e0 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -28,6 +28,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-59997.patch \ file://CVE-2026-59998.patch \ file://CVE-2026-59996.patch \ + file://CVE-2026-59995.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92938 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CE98C44531 for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3615.1784570226377132936 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VInJyR1i; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6098; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ZpE5IF/kdb6NL/9ti4ooSWs6PRm6vu10DDK37IE+HZ4=; b=VInJyR1iCJEzNgjQNXYJZvwscJ2haQkAcmRSDopURWA82dTy4zA+t1kA zsi8UIOOuzYI8wmzO1WEFyjdLmdqYBGB++xtaeN75A/80bdKEH4HxJ+m8 R78rW3A13t/WjXRv3Pi+epqCJOsKOhcNzuQqzK9HOHTlOK4U4u63JuT3r AILGhxV7cZxy7MClR3wcHCZf93N/LoQku873RO3e2w6KALu1Co/YhdB9n qhsnssiajnXzZNKA6aN7QhIVaCq8mRkNbriS7PZmsnjqK6fb4ifWLjKrL h23UqaUZHLAdAeBZ15S30LqrRtPc75MtHIIN/Yy2fPkLzJDRO4IPjrn15 A==; X-CSE-ConnectionGUID: iKR+qQz0SPOIOZFsLJlljw== X-CSE-MsgGUID: uRgiYlpgRHiivOmCjPKdRw== X-IPAS-Result: A0BIAgA1YF5q/5D/Ja1aglmCV3RfQkmWTZ4bgX4PAQEBD0QNBAEBhD9GAo1TAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDJwsBGAEbEhAcAwECLysjCBmDAgGCdAIBEbt4gXkzgQGDKAE/AkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKBFYNpgQWBXAICAReICwSCInoSgVoej3RIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCDgMLGA1IESw3FBkEPm4HjUAjgkCBDgETGIIsHJNbkX+hDwoog3WMIZU6GjOqbAuYfY4KlTaBGoRpgWg8gVlwFYMiCUoZD44tCwuDYIUTyUckNQsyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:QTBUn62I6TgOHx9DoPbD5YJwkn2cJEfYwER7XKvMYLTBsI5bpzFSx mcZDWiHOfaINGT8ftwnPtuxoU0C7JfXz4JgSwY53Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yFjmH4E/xbtANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 Lsen+WFYAX7g2EuajpKg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGDWIMfpQh6L5MOUZv0 s42MxQvahSBmLfjqF67YrEEasULNsLnOsYb/3pn1zycValgSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUicC/FMEg9/5JYWkOq2j3/kcyVwo1OOrq1x6G/WpOB0+OW0aouPIYLSG625mG6Fn G3HzmDhDSs6Nd2B7j+u8EqPitXQyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7GQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSj1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:rcNTg6v/jqec3gPY3TWog5q17skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:W0ZC7W9lB7vYf7vu6v6Vv083IIM8S2+F90/3AmiKJ31NarmRS0DFrQ== X-Talos-MUID: 9a23:meNaFQt35ZWIEhvSbs2nmQttNfZs+6uUKEEMj7IDkMu8FiBKJGLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512923606" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id BFDBD180003CE; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id 1B931CEC317; Mon, 20 Jul 2026 10:57:05 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 6/8] openssh: Fix CVE-2026-60001 Date: Mon, 20 Jul 2026 10:55:16 -0700 Message-Id: <20260720175518.3546447-6-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241472 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-60001. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454 [2] https://www.cve.org/CVERecord?id=CVE-2026-60001 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 131 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch new file mode 100644 index 0000000000..aa32484b17 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch @@ -0,0 +1,130 @@ +From 6bc7dd87d543c882994f95c8309846dfda9ab503 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 6 Jul 2026 07:44:48 +0000 +Subject: [PATCH] upstream: Fix cases in GSSAPI and keyboard-interactive + +authentication where the minimum per-attempt delay was not being enforced. + +Reported by Orange Cyberdefense Vulnerability Team + +OpenBSD-Commit-ID: c40bd35cc2428fcaccad7a141703c28baa6da01e + +CVE: CVE-2026-60001 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunks in auth.h, + auth2-chall.c, auth2-gss.c, and auth2.c and retained the Wrynose + OpenSSH 10.3p1 revisions because this stable backport carries only the + functional security changes. + +(cherry picked from commit d43ba60c91cb323ca921049b7d43b1908c318454) +Signed-off-by: Devansh Patel +--- + auth.h | 1 + + auth2-chall.c | 4 ++++ + auth2-gss.c | 7 +++++++ + auth2.c | 10 ++++++++-- + 4 files changed, 20 insertions(+), 2 deletions(-) + +diff --git a/auth.h b/auth.h +index 634a84aa8..c2cfa5ed8 100644 +--- a/auth.h ++++ b/auth.h +@@ -175,6 +175,7 @@ void auth_log(struct ssh *, int, int, const char *, const char *); + void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn)); + void userauth_finish(struct ssh *, int, const char *, const char *); + int auth_root_allowed(struct ssh *, const char *); ++void auth_failure_delay(Authctxt *, double); + + char *auth2_read_banner(void); + int auth2_methods_valid(const char *, int); +diff --git a/auth2-chall.c b/auth2-chall.c +index f3889079b..4687ca8e2 100644 +--- a/auth2-chall.c ++++ b/auth2-chall.c +@@ -300,6 +300,7 @@ input_userauth_info_response(int type, uint32_t seq, struct ssh *ssh) + u_int i, nresp; + const char *devicename = NULL; + char **response = NULL; ++ double tstart = monotime_double(); + + if (authctxt == NULL) + fatal_f("no authctxt"); +@@ -358,6 +359,9 @@ input_userauth_info_response(int type, uint32_t seq, struct ssh *ssh) + auth2_challenge_start(ssh); + } + } ++ ++ if (!authenticated) ++ auth_failure_delay(authctxt, tstart); + userauth_finish(ssh, authenticated, "keyboard-interactive", + devicename); + return 0; +diff --git a/auth2-gss.c b/auth2-gss.c +index 053548527..f27ac9221 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -255,6 +255,7 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh) + { + Authctxt *authctxt = ssh->authctxt; + int r, authenticated; ++ double tstart = monotime_double(); + + if (authctxt == NULL) + fatal("No authentication or GSSAPI context"); +@@ -268,6 +269,8 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh) + fatal_fr(r, "parse packet"); + + authenticated = mm_ssh_gssapi_userok(authctxt->user); ++ if (!authenticated) ++ auth_failure_delay(authctxt, tstart); + + authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +@@ -288,6 +291,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh) + gss_buffer_desc mic, gssbuf; + u_char *p; + size_t len; ++ double tstart = monotime_double(); + + if (authctxt == NULL) + fatal("No authentication or GSSAPI context"); +@@ -315,6 +319,9 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh) + sshbuf_free(b); + free(mic.value); + ++ if (!authenticated) ++ auth_failure_delay(authctxt, tstart); ++ + authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); +diff --git a/auth2.c b/auth2.c +index 3a1682746..7ba611c02 100644 +--- a/auth2.c ++++ b/auth2.c +@@ -265,6 +265,12 @@ ensure_minimum_time_since(double start, double seconds) + nanosleep(&ts, NULL); + } + ++void ++auth_failure_delay(Authctxt *authctxt, double tstart) ++{ ++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user)); ++} ++ + static int + input_userauth_request(int type, uint32_t seq, struct ssh *ssh) + { +@@ -346,8 +352,8 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh) + authenticated = m->userauth(ssh, method); + } + if (!authctxt->authenticated && strcmp(method, "none") != 0) +- ensure_minimum_time_since(tstart, +- user_specific_delay(authctxt->user)); ++ auth_failure_delay(authctxt, tstart); ++ + userauth_finish(ssh, authenticated, method, NULL); + r = 0; + out: diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 4aa81214e0..dba0dcaa8a 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -29,6 +29,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-59998.patch \ file://CVE-2026-59996.patch \ file://CVE-2026-59995.patch \ + file://CVE-2026-60001.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92933 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28A5FC44529 for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3656.1784570226468789114 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Qkdc7T9V; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9482; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=IKREtDyPRtOVdKXPGohaXyWPdxwV9gsljGCBxGUzwn4=; b=Qkdc7T9Vdz647J1MZS9dl+Ttn/rfMOkuY+86++Y63Bb5pDQasNARU7qG 4AyZKV9JP6SOuNlLmKltGo48NxsYY+BY0f1C6237I0mG7XcaRwNoFNiZJ 7f4qxtJ+ewipXDC7NKz4I3MB8tMfxNQYwLw4BtdR7cy3MLyRT7Hfs9GQt 29ErmgsIrSragPrTiCtLyddzr4uQDYbzwYUhsWUb0kriIffZRhNYeFzil VLLktr6CeZBzjzAZp+WfYe7JfmDOttBQchR4ketzu2NVGiD7VWQfx7tS/ v6pSjmsC5Y6a3mGpJx+JlWJknhHZFIEWlm5fkqjAF/sQtxFYjxCmR6GUY A==; X-CSE-ConnectionGUID: s933WEbzQYq3gD/ruvYMQA== X-CSE-MsgGUID: K2/zQmU6QwW7wbuqcSu4NQ== X-IPAS-Result: A0BKAgCzYF5q/4z/Ja1aglmCV3RfQkmWSgOBE50IgX4PAQEBD0QNBAEBhD9GAo1TAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDJwsBGAEbEhAcAwECFwEXKyMIGRmCaQGCdAIBEbt8gXkzgQGDKAE/AkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKBFYJzdoEFgVwCAgEXgS5gAoV7BIIiehKBWh6DXowWSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EMGwcFgR2BOoEChHQjHwM5f4EvdUp3LWkBEheBJoISAoE7Ag4DCxgNSBEsNxQZBD5uB41AI4JAfw8BExiBGjdbHJMSEZI3gTWfWgoog3WMIY4Nhy0aM4VbpRELmH2OCpZQhGmBaDyBWXAVgyIJShkPji0LC4NghRPJRyQ1CzIBAQcCBw4DC4FokAKBfAEB IronPort-Data: A9a23:BM0Si6A5+wrBCRVW/3jiw5YqxClBgxIJ4kV8jS/XYbTApGt0gmcBy mEeUG3Ubq2PNmf3KN13YInlpBtXvcTQzoQ1OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGdIZvCCeA+n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXmthh fuo+5eBYAD/g2YqWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE2KQ1V34bN58hy/8sDk0J7 +EGGRU0R0XW7w626OrTpuhEnM8vKozveYgYoHwllWqfBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY3BPjDS0Un1lM/BJ8gleGzhmHXeDxDo1XTrq0yi4TW5FEoiuCybYaIIbRmQ+12xAGKn 2f7oV3mPU4FPsGGwgGYrlSV07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KPpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOb9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:0s02+6HlPSxRThlwpLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:FukfyW2Ab/TdiScE2GlL+rxfAZF+KULwxmXpElbjBkouUqCLeHqp0fYx X-Talos-MUID: 9a23:o/hOVQvRXpQJBULvv82np2slJv5t3vqXF39Sjp8bosK/KHBWAmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512075453" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id BFCDE180001C7; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id 1E2EECEC318; Mon, 20 Jul 2026 10:57:05 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 7/8] openssh: Fix CVE-2026-60002 Date: Mon, 20 Jul 2026 10:55:17 -0700 Message-Id: <20260720175518.3546447-7-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241473 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-60002. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23 [2] https://www.cve.org/CVERecord?id=CVE-2026-60002 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-60002.patch | 225 ++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch new file mode 100644 index 0000000000..85937279a2 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch @@ -0,0 +1,225 @@ +From b571549bc93e95f0d3d563094f825544228501de Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 6 Jul 2026 07:49:58 +0000 +Subject: [PATCH] upstream: fix ownership and lifetime of several bits of + client + +state that need to persist for the life of the connection, especially the +cached hostkey that was being incorrectly freed early on some paths, possibly +allowing its use after free. + +Reported by Zhenpeng (Leo) Lin from depthfirst.com + +OpenBSD-Commit-ID: faaa6ad72e7d69d41fa8b197b606265b7d9bc73f + +CVE: CVE-2026-60002 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunks in ssh.c, + sshconnect.c, sshconnect.h, and sshconnect2.c and retained the Wrynose + OpenSSH 10.3p1 revisions because this stable backport carries only the + functional security changes. + +(cherry picked from commit e8bdfb151a356d0171fea4194dd205fbb252be23) +Signed-off-by: Devansh Patel +--- + ssh.c | 24 ++---------------------- + sshconnect.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-- + sshconnect.h | 7 +++++-- + sshconnect2.c | 20 +++++++++++--------- + 4 files changed, 63 insertions(+), 35 deletions(-) + +diff --git a/ssh.c b/ssh.c +index 531f28eb2..efb8930f4 100644 +--- a/ssh.c ++++ b/ssh.c +@@ -612,26 +612,6 @@ set_addrinfo_port(struct addrinfo *addrs, int port) + } + } + +-static void +-ssh_conn_info_free(struct ssh_conn_info *cinfo) +-{ +- if (cinfo == NULL) +- return; +- free(cinfo->conn_hash_hex); +- free(cinfo->shorthost); +- free(cinfo->uidstr); +- free(cinfo->keyalias); +- free(cinfo->thishost); +- free(cinfo->host_arg); +- free(cinfo->portstr); +- free(cinfo->remhost); +- free(cinfo->remuser); +- free(cinfo->homedir); +- free(cinfo->locuser); +- free(cinfo->jmphost); +- free(cinfo); +-} +- + /* + * Main program for the ssh client. + */ +@@ -1799,8 +1779,8 @@ main(int ac, char **av) + ssh_signal(SIGCHLD, main_sigchld_handler); + + /* Log into the remote system. Never returns if the login fails. */ +- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr, +- options.port, pw, timeout_ms, cinfo); ++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port, ++ pw, timeout_ms, cinfo); + + /* We no longer need the private host keys. Clear them now. */ + if (sensitive_data.nkeys != 0) { +diff --git a/sshconnect.c b/sshconnect.c +index 4384277a6..3d338ff23 100644 +--- a/sshconnect.c ++++ b/sshconnect.c +@@ -70,6 +70,49 @@ extern char *__progname; + static int show_other_keys(struct hostkeys *, struct sshkey *); + static void warn_changed_key(struct sshkey *); + ++void ++ssh_conn_info_free(struct ssh_conn_info *cinfo) ++{ ++ if (cinfo == NULL) ++ return; ++ free(cinfo->conn_hash_hex); ++ free(cinfo->shorthost); ++ free(cinfo->uidstr); ++ free(cinfo->keyalias); ++ free(cinfo->thishost); ++ free(cinfo->host_arg); ++ free(cinfo->portstr); ++ free(cinfo->remhost); ++ free(cinfo->remuser); ++ free(cinfo->homedir); ++ free(cinfo->locuser); ++ free(cinfo->jmphost); ++ freezero(cinfo, sizeof(*cinfo)); ++} ++ ++struct ssh_conn_info * ++ssh_conn_info_dup(const struct ssh_conn_info *cinfo) ++{ ++ struct ssh_conn_info *ret; ++ ++ if (cinfo == NULL) ++ return NULL; ++ ret = xcalloc(1, sizeof(*ret)); ++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex); ++ ret->shorthost = xstrdup(cinfo->shorthost); ++ ret->uidstr = xstrdup(cinfo->uidstr); ++ ret->keyalias = xstrdup(cinfo->keyalias); ++ ret->thishost = xstrdup(cinfo->thishost); ++ ret->host_arg = xstrdup(cinfo->host_arg); ++ ret->portstr = xstrdup(cinfo->portstr); ++ ret->remhost = xstrdup(cinfo->remhost); ++ ret->remuser = xstrdup(cinfo->remuser); ++ ret->homedir = xstrdup(cinfo->homedir); ++ ret->locuser = xstrdup(cinfo->locuser); ++ ret->jmphost = xstrdup(cinfo->jmphost); ++ return ret; ++} ++ + /* Expand a proxy command */ + static char * + expand_proxy_command(const char *proxy_command, const char *user, +@@ -1585,8 +1628,8 @@ warn_nonpq_kex(void) + */ + void + ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost, +- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms, +- const struct ssh_conn_info *cinfo) ++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw, ++ int timeout_ms, const struct ssh_conn_info *cinfo) + { + char *host; + char *server_user, *local_user; +diff --git a/sshconnect.h b/sshconnect.h +index 4c19490da..8da0e04b9 100644 +--- a/sshconnect.h ++++ b/sshconnect.h +@@ -76,7 +76,7 @@ int ssh_connect(struct ssh *, const char *, const char *, + void ssh_kill_proxy_command(void); + + void ssh_login(struct ssh *, Sensitive *, const char *, +- struct sockaddr *, u_short, struct passwd *, int, ++ struct sockaddr_storage *, u_short, struct passwd *, int, + const struct ssh_conn_info *); + + int verify_host_key(char *, struct sockaddr *, struct sshkey *, +@@ -85,7 +85,7 @@ int verify_host_key(char *, struct sockaddr *, struct sshkey *, + void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short, + char **, char **); + +-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short, ++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short, + const struct ssh_conn_info *); + + void ssh_userauth2(struct ssh *ssh, const char *, const char *, +@@ -101,3 +101,6 @@ void load_hostkeys_command(struct hostkeys *, const char *, + const struct sshkey *, const char *); + + int hostkey_accepted_by_hostkeyalgs(const struct sshkey *); ++ ++void ssh_conn_info_free(struct ssh_conn_info *); ++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *); +diff --git a/sshconnect2.c b/sshconnect2.c +index 478a9a52f..50ac6b89d 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -83,7 +83,7 @@ extern Options options; + */ + + static char *xxx_host; +-static struct sockaddr *xxx_hostaddr; ++static struct sockaddr_storage xxx_hostaddr; + static const struct ssh_conn_info *xxx_conn_info; + static int key_type_allowed(struct sshkey *, const char *); + +@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) + fatal("Server host key %s not in HostKeyAlgorithms", + sshkey_ssh_name(hostkey)); + } +- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, ++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey, + xxx_conn_info) != 0) + fatal("Host key verification failed."); + return 0; +@@ -216,16 +216,16 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, + } + + void +-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, +- const struct ssh_conn_info *cinfo) ++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr, ++ u_short port, const struct ssh_conn_info *cinfo) + { + char *myproposal[PROPOSAL_MAX]; + char *all_key, *hkalgs = NULL; + int r, use_known_hosts_order = 0; + +- xxx_host = host; +- xxx_hostaddr = hostaddr; +- xxx_conn_info = cinfo; ++ xxx_host = xstrdup(host); ++ xxx_hostaddr = *hostaddr; ++ xxx_conn_info = ssh_conn_info_dup(cinfo); + + if (options.rekey_limit || options.rekey_interval) + ssh_packet_set_rekey_limits(ssh, options.rekey_limit, +@@ -248,8 +248,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, + fatal_fr(r, "kex_assemble_namelist"); + free(all_key); + +- if (use_known_hosts_order) +- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo); ++ if (use_known_hosts_order) { ++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr, ++ port, cinfo); ++ } + + kex_proposal_populate_entries(ssh, myproposal, + options.kex_algorithms, options.ciphers, options.macs, diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index dba0dcaa8a..d3d00b994d 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -30,6 +30,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-59996.patch \ file://CVE-2026-59995.patch \ file://CVE-2026-60001.patch \ + file://CVE-2026-60002.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Mon Jul 20 17:55:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92936 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19336C4452D for ; Mon, 20 Jul 2026 17:57:09 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3617.1784570226845009020 for ; Mon, 20 Jul 2026 10:57:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IiKv5kou; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6510; q=dns/txt; s=iport01; t=1784570226; x=1785779826; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=UL2BQJX82e0Lv6hmdKQyJhqNmqs5OISl2wIdOt0B1c0=; b=IiKv5kouDR6KODMQiSlHNMa7AC8OS2kzefKW0+gzVWlFgujQUmuVz8NV 5W4BpE8Q7ab8BXemjX9b9zfM7R1vio414PTfnWgATq0i+3WfD7SpqCVWQ GiEqM1WDRo/Vm8UyHo9BkP3We6El7Pv733+wNx7Jk974iNdfdQ7/2Snr+ YRdCk/domVMK8US6PT7DCcvgo7DvTv/Y2jgeMDobZe9ypAeM71ff5vu2j cO8i/Z0EFMbJWHXzkJtZ/eCZaSHLOzq0ZPjvsFWNeSFEHecujjj5K8q5N MEP8bKzilAgcfx+DxsD/f5KiX6t8st7Rs2sjGoV8btUPckX3R/skJYmjM w==; X-CSE-ConnectionGUID: qkfC+F7WSEmp+U64Sx8vnw== X-CSE-MsgGUID: /v+k3xMbSRSE4v910wVXVA== X-IPAS-Result: A0BIAgAwYV5q/4z/Ja1aglmCV3RfQkmWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNUwImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAycLARgBGxIQHAMBAi8rIwgZgwIBgnQCARG7aoF5M4EBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FygRWBO4IugQWBXAICAReICwSCInoSgVoej3RIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCDgMLGA1IESw3FBkEPm4HjUAjgTxBMw8BWiEJCgETGBc/JYECLwYWBpMMEZI3gTWfWgoog3WMIZU6GjOqbAuYfY4KlTYyC12EaYFoPIFZcBWDIglKGQ+OLQsLg2CFE8lHJDULMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:jn6mJq3mTXTP3qyNy/bD5YJwkn2cJEfYwER7XKvMYLTBsI5bpzAPm zBMCmuOMveMamL9KI9+Oduw8R4B75CDnNJkSlA53Hw8FHgiRegpqji6wuYcGwvIc6UvmWo+t 512huHodZ5yFjmH4E/xbtANlFEkvYmQXL3wFeXYDS54QA5gWU8JhAlq8wIDqtYAbeORXUXX5 Lsen+WFYAX7g2EuajpKg06+gEoHUMra6WtwUmMWPZinjHeG/1EJAZQWI72GLneQauF8Au6gS u/f+6qy92Xf8g1FIovNfmHTKxBirhb6ZGBiu1IOM0SQqkEqSh8ajs7XAMEhhXJ/0F1lqTzeJ OJl7vRcQS9xVkHFdX90vxNwS0mSNoUekFPLzOTWXcG7lyX7n3XQL/pGFUI4Fs42pdlMLGRWt sFGdAsdPg6FmLfjqF67YrEEasULNsLnOsYb/3pn1zycVa1gSpHYSKKM7thdtNsyrpkRRrCFO IxDNGcpNUiYC/FMEg9/5JYWkOq2j3/kcyVwo1OOrq1x6G/WpOB0+OW0a4aNI4faFK25mG7fu CHFpHTcCCogD/HD12vcqm2SttHmyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7CQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSj1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:pcunaqmVUbzo9qsnEbBHK5AuKpjpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:kVJLX24E/QW3qC7hF9ss7U0aMYMLLULm4XLIYHLmVV15GKOTVgrF X-Talos-MUID: 9a23:LgKRvgmfrVM9i/ssDTIYdnolKoRruLSLAns3qrhapZjdbTNOCwm02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="513401389" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 17:57:05 +0000 Received: from sjc-ads-20746.cisco.com (sjc-ads-20746.cisco.com [171.70.189.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id C14A718000612; Mon, 20 Jul 2026 17:57:05 +0000 (GMT) Received: by sjc-ads-20746.cisco.com (Postfix, from userid 1887503) id 3AB05CEC319; Mon, 20 Jul 2026 10:57:05 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][wrynose][PATCH 8/8] openssh: Fix CVE-2026-60000 Date: Mon, 20 Jul 2026 10:55:18 -0700 Message-Id: <20260720175518.3546447-8-devanshp@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com> References: <20260720175518.3546447-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-20746.cisco.com [171.70.189.245];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 171.70.189.245, sjc-ads-20746.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 17:57:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241474 From: Devansh Patel This patch applies the upstream OpenSSH 10.4p1 backport for CVE-2026-60000. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192 [2] https://www.cve.org/CVERecord?id=CVE-2026-60000 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-60000.patch | 140 ++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 141 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch new file mode 100644 index 0000000000..e9b62e6454 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch @@ -0,0 +1,140 @@ +From 884e94fafb20259c78bf394611b9929a7683e2b3 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 6 Jul 2026 07:53:30 +0000 +Subject: [PATCH] upstream: Fix multiple RFC 4462 (GSSAPIAuthentication) + compliance + +problems + +1) Remove an early failure return for GSSAPI authentication attempts +made for invalid accounts that yielded different behaviour for +valid vs invalid accounts. + +2) Fix a situation where some GSSAPI requestes were not correctly +subjected to MaxAuthTries. + +3) Fix a moderate pre-authentication resource DoS related to #2. + +Add missing logging for error cases. + +Report and fixes from Manfred Kaiser, milCERT AT + +OpenBSD-Commit-ID: ca0acdd64eea435d6f89534538a9eb404a5629d3 + +CVE: CVE-2026-60000 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk in auth2-gss.c and + retained the Wrynose OpenSSH 10.3p1 revision because this stable + backport carries only the functional security change. + +(cherry picked from commit 5d04ca6af739b82fd30d84d2783ca802ebfa1192) +Signed-off-by: Devansh Patel +--- + auth2-gss.c | 53 ++++++++++++++++++++++++----------------------------- + 1 file changed, 24 insertions(+), 29 deletions(-) + +diff --git a/auth2-gss.c b/auth2-gss.c +index f27ac9221..54c96fe4b 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -111,12 +111,6 @@ userauth_gssapi(struct ssh *ssh, const char *method) + return (0); + } + +- if (!authctxt->valid || authctxt->user == NULL) { +- debug2_f("disabled because of invalid user"); +- free(doid); +- return (0); +- } +- + if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, &goid))) { + if (ctxt != NULL) + ssh_gssapi_delete_ctx(&ctxt); +@@ -178,8 +172,14 @@ input_gssapi_token(int type, uint32_t plen, struct ssh *ssh) + (r = sshpkt_send(ssh)) != 0) + fatal_fr(r, "send ERRTOK packet"); + } ++ logit("Failed gssapi-with-mic for %s%.100s " ++ "from %.200s port %d ssh2", ++ authctxt->valid ? "" : "invalid user ", ++ authctxt->user, ++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); + authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); ++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); + userauth_finish(ssh, 0, "gssapi-with-mic", NULL); + } else { + if (send_tok.length != 0) { +@@ -191,14 +191,18 @@ input_gssapi_token(int type, uint32_t plen, struct ssh *ssh) + fatal_fr(r, "send TOKEN packet"); + } + if (maj_status == GSS_S_COMPLETE) { +- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +- if (flags & GSS_C_INTEG_FLAG) +- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, ++ ssh_dispatch_set(ssh, ++ SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); ++ /* note: keep ERRTOK handler as per RFC 4462 s3.4 */ ++ if (flags & GSS_C_INTEG_FLAG) { ++ ssh_dispatch_set(ssh, ++ SSH2_MSG_USERAUTH_GSSAPI_MIC, + &input_gssapi_mic); +- else ++ } else { + ssh_dispatch_set(ssh, + SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, + &input_gssapi_exchange_complete); ++ } + } + } + +@@ -210,10 +214,6 @@ static int + input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh) + { + Authctxt *authctxt = ssh->authctxt; +- Gssctxt *gssctxt; +- gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; +- gss_buffer_desc recv_tok; +- OM_uint32 maj_status; + int r; + u_char *p; + size_t len; +@@ -221,26 +221,21 @@ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh) + if (authctxt == NULL) + fatal("No authentication or GSSAPI context"); + +- gssctxt = authctxt->methoddata; +- if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 || ++ /* Minimal error handling - just cancel auth and return FAILURE */ ++ if ((r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0 || + (r = sshpkt_get_end(ssh)) != 0) + fatal_fr(r, "parse packet"); +- recv_tok.value = p; +- recv_tok.length = len; +- +- /* Push the error token into GSSAPI to see what it says */ +- maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok, +- &send_tok, NULL); +- +- free(recv_tok.value); + +- /* We can't return anything to the client, even if we wanted to */ ++ logit("Failed gssapi-with-mic for %s%.100s from %.200s port %d ssh2", ++ authctxt->valid ? "" : "invalid user ", ++ authctxt->user, ++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); ++ authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); +- +- /* The client will have already moved on to the next auth */ +- +- gss_release_buffer(&maj_status, &send_tok); ++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL); ++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL); ++ userauth_finish(ssh, 0, "gssapi-with-mic", NULL); + return 0; + } + diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index d3d00b994d..768ffcfbea 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -31,6 +31,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-59995.patch \ file://CVE-2026-60001.patch \ file://CVE-2026-60002.patch \ + file://CVE-2026-60000.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"