From patchwork Mon Jul 20 18:57:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92949 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41EEEC44531 for ; Mon, 20 Jul 2026 18:58:02 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4966.1784573873450746313 for ; Mon, 20 Jul 2026 11:57:53 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=WvnDCQxp; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2978; q=dns/txt; s=iport01; t=1784573873; x=1785783473; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=9VnTC4fri1EfqUt29IR7i1d+tvLKzmZyS4vjQAs2L/k=; b=WvnDCQxpg9swWQxnbE8k0A/1QiO1Oew5w21W0szsqWKYRegZnnPcR7BR 02UHJB1jde5MpU5nOuyhnqOYxeinkoDRcjfzv4tyYhLfWTNwlZQV5Te8c l2I3CAwWEQJDx9fD7lpFukM0W93PdseLP638DrdzKXte6a3brQb0UyrVm 8gb8ChvVpyoWJMVWp4wSlAIBqJsciwrEJdpt+fYQMXfL5G9v5DFnfq+7G 5iJE5f+5PqXTYUJWvfxB2El5b2mYauDt4bDtia5wra/fUw93VdRM7At42 Miz0Qhw61CGHTgFxcHyytuucgUTE3NxXgiKkUkEGjm4YP3uDRixK0hgS8 A==; X-CSE-ConnectionGUID: kOGKH63RR4iqZvxwBFRG7A== X-CSE-MsgGUID: yZrOqmVSSiWg9wYsngXHpg== X-IPAS-Result: A0BHAgAQb15q/4r/Ja1aglmCV3ReQ0mWTZ4bgX4PAQEBD0QNBAEBhD9GAo1VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDMgEYAS0QHAMBAi8rIwgZgwIBgnQDEbwFgiyBAYMoAT8CQ1DbLgELFAEFgTOFP4ggXBgBhHwnGxuBcoEVg2mBBYFcAQEDgSQhZYV4BIIiehKBWh6PeUiBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBDBsHBYEdgTqBAoR0Ix8DOX+BL3VKdy1pARIXgSaCEgKBOwITAwsYDUgRLDcUGQQ+bgeNQSOCQIEOASoBlhySBoE1n1oKKIN1jCGVOhozqmwLmH2OCpZQhGmBaDyBRwsHcBWDIglKGQ+OOINrgX+DFMlHJzILMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:aRVGcanH5LusyR3GoIn6waPo5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIdW2CHOfiJY2P3fIggOoix8klU7Z/VyYRlTwE//Ho9RltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4E/raf658SUUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZC31GONgWYubDpLsfrb9nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FY4/1cVXXzp0z 6AZMQITfg+pqdiZn5vuH4GAhux7RCXqFJkUtnclyXTSCuwrBMiaBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaj/7C7pm9AusrnXybTRes1KNjaE2+GPUigd21dABNfKII4bUG5wLxxfwS mTu7lbjJQgfCuekyAWKo22dnenArQPjV9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cF3hKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:JZplN6FjbuvyiczypLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHPxOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:Y/EW4Wqff5b5PEUorPkM0AjmUcMCXV79kizqGRO5EFR3WKK/Z2W/p4oxxg== X-Talos-MUID: 9a23:zMwrMw+IwEMqOoectGH9OXGQf9Za+YO3DX42qpQ5tJibBDd2NAe9lDviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512661619" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:52 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 7AF6E180001C7; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 1FDE8CC12A7; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999 Date: Mon, 20 Jul 2026 11:57:42 -0700 Message-ID: <20260720185749.4098075-2-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241477 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-59999. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59999 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59999.patch | 36 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch new file mode 100644 index 0000000000..89b7aa9c7f --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch @@ -0,0 +1,36 @@ +From 1c719fa7d0fb0aa335f0e8d5db5d5e5d01c894e5 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 31 May 2026 04:47:29 +0000 +Subject: [PATCH] upstream: DisableForwarding=yes didn't override + PermitTunnel=yes + +Reported independently by Huzaifa Sidhpurwala of Redhat and Marko +Jevtic; ok markus@ + +CVE: CVE-2026-59999 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753] + +Backport Changes: +- Retained the Scarthgap serverloop.c OpenBSD revision identifier because + the 10.4 identifier does not describe the older source baseline. + +OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c +(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753) +Signed-off-by: Devansh Patel +--- + serverloop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/serverloop.c b/serverloop.c +index f3683c2e4..c1fe99d12 100644 +--- a/serverloop.c ++++ b/serverloop.c +@@ -531,7 +531,7 @@ server_request_tun(struct ssh *ssh) + ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); + return NULL; + } +- if ((options.permit_tun & mode) == 0) { ++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) { + ssh_packet_send_debug(ssh, "Server has rejected tunnel device " + "forwarding"); + return NULL; diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 4193bc8a5b..efb89d45d7 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -37,6 +37,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-35385.patch \ file://CVE-2026-35414-CVE-2026-35387.patch \ file://CVE-2026-35388.patch \ + file://CVE-2026-59999.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92946 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8FC38C4452D for ; Mon, 20 Jul 2026 18:58:01 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4969.1784573873556979391 for ; Mon, 20 Jul 2026 11:57:53 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KBZpazti; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3597; q=dns/txt; s=iport01; t=1784573873; x=1785783473; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Yb9pR3eZ7I6H9uMbLjYJVwJusFFI05X/KER8Hr5f9Rc=; b=KBZpazti7xbYIesShTY7edqmW2mG5vdQgSFe9P5r2mUI9YsD0RDvcZVc xPvXqlLk/SJpxu4vd1KcjGaUJXgnoeD0ftBytD+orE/qTCEv/7QxL+3r6 3g+YJZSfbRJBQojxjSNxzCER6lPb+OFCkNXiTVgfh3blzRiJDm76dqcmk fMptRWhNY+ixKbMRKblTMxX/0gucb72mdSvQ4lvI05OqXI1sjaCYvWIq8 hWs6fUIAqJxrwS24YKMu+jHJ7QADeo4o6c8CpqDUyMo97IPYWbeOcwDai DSWkBFltXs0yDq7E0KvR6KA9S52PbDY60lwCYxt1Ucfn6751laKIhPQnv Q==; X-CSE-ConnectionGUID: UqEOeuFmRpSZUuflx9Q9Nw== X-CSE-MsgGUID: 4U2hIAaTTiWo3ortbBxCIw== X-IPAS-Result: A0BIAgAQb15q/5X/Ja1aglmCV3ReQ0mWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNVQImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRvAWBeTOBAYMoAT8CQ1DbLgELFAEFgTOFP4ggXBgBhHwnGxuBcoEVg2mBBYFcAQEDgUWGXQSCInoSgVoej3lIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCEwMLGA1IESw3FBkEPm4HjUEjgkB7EwEqAYEggRqlaKEPCiiDdYwhlToaM6psC5h9jgqWUIRpgWg8gUcLB3AVgyIJShkPjjiDa4F/gxTJRycyCzIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:OpEI6KmeHKpDmZcXj6f7nifo5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJKCzzTOvmLNmenKI1zaNjioB8O6pPXyNc2SQBqpS81HltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4E/raf658SUUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZC31GONgWYubDpLsfrb9nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FbAB18F6HE9Lz +QjGg0QYBST1tvn5q3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMmZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTaz/7C7pm9AusrnXybTRes1KNjaE2+GPUigd21dABNfKII4fWH5oMzxvwS mTuo1mjAjAzPeCjyAWCqXW2muXljQjaR9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1dFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Oxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:/eJtf6FDAayCnRoRpLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHPxOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:DhGJz2vuhVVihFHqTtLPfWPN6IsYa1D6wWr+JnWgMlRUVbORWQ6pqYV7xp8= X-Talos-MUID: 9a23:rK2qfwRo7FuGZczdRXSwuWtiFe5h35ivN0dWlo8aseOUHg1vbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="513427195" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:52 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 7F4E018000326; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 25246CC12A8; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997 Date: Mon, 20 Jul 2026 11:57:43 -0700 Message-ID: <20260720185749.4098075-3-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241478 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-59997. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59997 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59997.patch | 58 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 59 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch new file mode 100644 index 0000000000..aa171def01 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch @@ -0,0 +1,58 @@ +From 3011cbb6bb73f3f3dc90fa1d48736803fa407509 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Fri, 5 Jun 2026 08:53:07 +0000 +Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp + server, + +previously they were silently dropped; reported by Steve Caffrey ok deraadt@ + +CVE: CVE-2026-59997 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014] + +Backport Changes: +- Retained the Scarthgap session.c OpenBSD revision identifier because the + 10.4 identifier does not describe the older source baseline. + +OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624 +(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014) +Signed-off-by: Devansh Patel +--- + session.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/session.c b/session.c +index eb932b8bf..1a01ecf74 100644 +--- a/session.c ++++ b/session.c +@@ -1650,21 +1650,22 @@ do_child(struct ssh *ssh, Session *s, const char *command) + exit(1); + } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) { + extern int optind, optreset; +- int i; +- char *p, *args; ++ int sftp_argc; ++ char **sftp_argv; + + setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME); +- args = xstrdup(command ? command : "sftp-server"); +- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " "))) +- if (i < ARGV_MAX - 1) +- argv[i++] = p; +- argv[i] = NULL; ++ if (argv_split(command == NULL ? "sftp-server" : command, ++ &sftp_argc, &sftp_argv, 1) != 0) { ++ error("internal error: can't split internal-sftp " ++ "arguments"); ++ exit(1); ++ } + optind = optreset = 1; +- __progname = argv[0]; ++ __progname = sftp_argv[0]; + #ifdef WITH_SELINUX + ssh_selinux_change_context("sftpd_t"); + #endif +- exit(sftp_server_main(i, argv, s->pw)); ++ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw)); + } + + fflush(NULL); diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index efb89d45d7..3c706b00ae 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -38,6 +38,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-35414-CVE-2026-35387.patch \ file://CVE-2026-35388.patch \ file://CVE-2026-59999.patch \ + file://CVE-2026-59997.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92950 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 595B0C44533 for ; Mon, 20 Jul 2026 18:58:02 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4968.1784573873503117380 for ; Mon, 20 Jul 2026 11:57:53 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=l0gs0d1N; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2928; q=dns/txt; s=iport01; t=1784573873; x=1785783473; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=La3YpEflsTKsd9uSGgQ9UK+2P6WqNyWRVf/W+BlYgfo=; b=l0gs0d1NvrRZIyF+u4uhVCJuYAed+k83lkik/Sv6ycR7YGunmLQ8S+L0 sZYADKDQX9Snq1cLYrSRGDzMotvzSrrS52Cc+SP+QTkPe49sTgBF92R6z djcNmz+FC/Yzih7IzdR5eWPHLSl/Oi7/oX0+DNYJoAhqSuQ9vyG6OMJoz U85Z5AUwzpaFmwv9M+OX1iuihnaL2JP+8WR6dXUzhHofqkwTs/5sgZ0KM zZ+XUWkhdwPmrpnXiB7qqs6O+hNFDJiSrARShE+NuVI+0qVow4mgFSeRw Jenhv8mI14YcVwrHVpBzXrFXlgDuCMGgbhL7d4n1hnTguwzpspplHlBKR w==; X-CSE-ConnectionGUID: wlUwaiZTQPaaI0fO8Juf1g== X-CSE-MsgGUID: ibxif7EWRfuuZ7UxSJIiug== X-IPAS-Result: A0BIAgCabl5q/5X/Ja1aglmCV3ReQ0mWTZ4bgX4PAQEBD0QNBAEBhD9GAo1VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDMgEYAS0QHAMBAi8rHQEFCBmDAgGCdAMRvAGCLIEBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FyhH6BBYFcAQEDgiqFeASCInoSgVoegX09jT9IgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCEwMLGA1IESw3FBkEPm4HjUEjgkBqJAEqAagioQ8KKIN1jCGVOhozqmwLmH2OCpU2gRqEaYFoPIFHCwdwFTuCZwlKGQ+OOINrgX+DFMlHJzILMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:2yS7naMBJLr/2c3vrR30lsFynXyQoLVcMsEvi/4bfWQNrUp23jQGn 2pOCmuHaaqIN2uhKtggOoyw8U8E6p/VzNJmGXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeaphyFTmE+kvF3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WV7lV e/a+ZWFZgf6gWYsbAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+pqMV4/PL8kw95+CEAW+ 9tICi0DNx/W0opawJrjIgVtrt4oIM+uOMYUvWttiGiDS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzPXwsYDUXUrsTIJ4zgu6unXnnWzZZs1mS46Ew5gA/ySQsieK3bYeFJIXiqcN9n0yIp 2yZ0lvDDAwHBoOi2QGn03Oxibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++NuUCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXOIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:O1PLY6r4aO7bOa6kMtAK2IAaV5rzeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5X43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0FWMqyXMbEDt7eY3CCIV/A93dKA7Kekwc3az3trUEVWTpsI1XYBNu5eeXcGPzWvwvECZe Kh2vY= X-Talos-CUID: 9a23:xtYNgGnAXJxjZk/BxIW2itGklN/XOWLZ8WjZIn2EMF5gQZzNR3jA2r5qysU7zg== X-Talos-MUID: 9a23:/fiVTA1j+qYrxxWYRx/BJNGmlTUj4q6+CU5SvKo8tdSZB3NNKwy/rTWqTdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512255861" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:52 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 81F8018000335; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 2C15CCC12A9; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998 Date: Mon, 20 Jul 2026 11:57:44 -0700 Message-ID: <20260720185749.4098075-4-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241479 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-59998. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59998 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59998.patch | 34 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch new file mode 100644 index 0000000000..a9a13aa70e --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch @@ -0,0 +1,34 @@ +From f1fd8585548735bcba25faa13073aafb5f8686ca Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 24 Jun 2026 06:55:12 +0000 +Subject: [PATCH] upstream: mention a caveat regarding + GSSAPIStrictAcceptorCheck in + +some environments + +CVE: CVE-2026-59998 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432] + +Backport Changes: +- Retained the Scarthgap sshd_config.5 OpenBSD revision identifier and + Mdocdate because the 10.4 values do not describe the older manual page. + +OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2 +(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432) +Signed-off-by: Devansh Patel +--- + sshd_config.5 | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sshd_config.5 b/sshd_config.5 +index 7e1a56cd0..e1c8dcaa2 100644 +--- a/sshd_config.5 ++++ b/sshd_config.5 +@@ -745,6 +745,7 @@ machine's default store. + This facility is provided to assist with operation on multi homed machines. + The default is + .Cm yes . ++This option may not be effective in Windows Active Directory environments. + .It Cm HostbasedAcceptedAlgorithms + Specifies the signature algorithms that will be accepted for hostbased + authentication as a list of comma-separated patterns. diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 3c706b00ae..256d90e7bd 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -39,6 +39,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-35388.patch \ file://CVE-2026-59999.patch \ file://CVE-2026-59997.patch \ + file://CVE-2026-59998.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92948 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3B97C44530 for ; Mon, 20 Jul 2026 18:58:01 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4966.1784573873450746313 for ; Mon, 20 Jul 2026 11:57:54 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=YmHfRJaX; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2874; q=dns/txt; s=iport01; t=1784573873; x=1785783473; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=gFMswEvsWiKtFx8bzYmeEAGh/oNW2wVMXfehTDUl9G4=; b=YmHfRJaXAYovq/MlmL3bWTXDp65OwsbML4+iPzZvWZPh/HjiCBufqF7j DYWw72kY/JNvP/wWcVxN0P+dFEMxIkE8HzQuzCL7Y2lOpVJcijJxfzfl6 p3PCLYSvtzWY9d88ENRvIz/s2/LNa1I402py3V/CT4rw8JplifxT1dlmd CUPdvS8mfLSvGQaWdnA4JavykP0ke8YhdhvoYwajIVDK0uTd0r4KT6aUs ZMcZAwnW2gQcllQhzOAQQjuj3RsuFJFcVvhpQyOlbnKckT58pVyxSrOkV sMJbVXTfleXcurAJe3G1nm+ZxCbXs6zkqek8Z4dkb9GLldfeEDNlFNFNt g==; X-CSE-ConnectionGUID: UbsiLL60RPGtYplDZprpZg== X-CSE-MsgGUID: C2i9xm8JSqeR66+GC6zYCA== X-IPAS-Result: A0BHAgAQb15q/5D/Ja1aglmCV3ReQ0mWTZ4bgX4PAQEBD0QNBAEBhD9GAo1VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDMgEYAS0QHAMBAi8rIwgZgwIBgnQDEbs0GjeCLIEBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FyhAh2gQWBXAEBA4IqhXgEgiJ6EoFaHo95SIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EMGwcFgR2BOoEChHQjHwM5f4EvdUp3LWkBEheBJoISAoE7AhMDCxgNSBEsNxQZBD5uB41BI4JAgQ4BKgGoIqEPCiiDdYwhlToaM6psC5h9jgqWUIRpgWg8gUcLB3AVgyIJShkPjjiDa4F/gxTJRycyCzIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:WL1Q0qk0eINhavTolUUGM0vo5gzQJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJND26Ab/zZM2KgftwlOty//U8HvpeAytJlSwprqHxgFVtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4E/raf658SUUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZC31GONgWYubDpLsfrb9nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FbAS4edTJT8Wz 8Q3NAEVajyxn/iu8r3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMicBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTZj/7C7pm9AusrnXybTRes1KNjaE2+GPUigd21dABNfKII4bUG5wLxB7wS mTu1D74UwEfZP6k0De/rCzvqcSRjxLQcddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cEXhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Pxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:qMwP36yQcq1TpvaMW/LcKrPw9L1zdoMgy1knxilNoNJuHfBw8P re+8jzuiWUtN98YhwdcJW7Scu9qBDnhPpICOsqXYtKNTOO0ADDEGgh1/qG/9SKIUPDH4BmuZ uIWpIObuEYdWIK7vrS0U2fD8sqxsWB/eSDgOfTyGoocCRRApsQljuQzm2gYzZLrM4sP+tAKK ah X-Talos-CUID: 9a23:7Ep/924ozcsjmokFOdssyUQPG+QBLCXn9FjMEle8JVRxUqWnRgrF X-Talos-MUID: 9a23:1zL2bA+3SdDlv6/CVyjCPb2Qf+wy4vW+DRAvqowLgZfadgNbZSWspx3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512661620" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:52 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 8694818000210; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 308D0CC124A; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996 Date: Mon, 20 Jul 2026 11:57:45 -0700 Message-ID: <20260720185749.4098075-5-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241483 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-59996. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59996 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59996.patch | 37 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch new file mode 100644 index 0000000000..b13390b25b --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch @@ -0,0 +1,37 @@ +From 762b3d438547893d62ce3e147dce6cef14697b09 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Sun, 28 Jun 2026 23:47:16 +0000 +Subject: [PATCH] upstream: resist that return ".." via remote glob during + +remote/remote copies, similar to fixes for bz3871 for remote/local copies. +From Swival scanner + +CVE: CVE-2026-59996 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78] + +Backport Changes: +- Retained the Scarthgap scp.c OpenBSD revision identifier because the + 10.4 identifier does not describe the older source baseline. + +OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5 +(cherry picked from commit 36480181fa22f98e180b4f9e10203480c0346c78) +Signed-off-by: Devansh Patel +--- + scp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/scp.c b/scp.c +index 2c21fa19a..00d87517d 100644 +--- a/scp.c ++++ b/scp.c +@@ -2043,6 +2043,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to, + goto out; + } + ++ /* Special handling for source of '..' */ ++ if (strcmp(filename, "..") == 0) ++ filename = "."; /* Download to dest, not dest/.. */ ++ + if (targetisdir) + abs_dst = sftp_path_append(target, filename); + else diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 256d90e7bd..c2e172c8d6 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -40,6 +40,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-59999.patch \ file://CVE-2026-59997.patch \ file://CVE-2026-59998.patch \ + file://CVE-2026-59996.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92951 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A51FC44520 for ; Mon, 20 Jul 2026 18:58:12 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4977.1784573885168214092 for ; Mon, 20 Jul 2026 11:58:05 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=bq9Lk5E+; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3061; q=dns/txt; s=iport01; t=1784573885; x=1785783485; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=afCZkoXkv3cv1cxNIfrc+ADjkH8bLpc6qA+LzNSlwO8=; b=bq9Lk5E+GxMWjp1UQkxx6SIShxqjppitiwqWQ0AcZBuEnglv+R45kkAH e2V3r8W0pT6MXOsoeQVX6jRyLg+fjytPbsMi4f9em1wYOT+M69PntVjfk 2VXUnM5YfipOqh7+lvgYfkueBOFv+mk+SuPc7Hzsf4TUKRXP1xHH+/9Lm 2LS4w0QEmKd5T7Sw1NuHTjT0sNY+BluDr8bZ7SP8uzcQmcukTs7hv5yOK f1vYw1dZtqzhk5G+ZXvLWRTJKfniduwv87j9QbYu8zM9yZsAubHhbrpgt M0ftxd0vGD83LYgERg/4QR5/gW5297rXCScQYwVepBeSmG10zaY4OCwFX Q==; X-CSE-ConnectionGUID: qWp7seqkRIOAeissx/kl6w== X-CSE-MsgGUID: Xsv2Wt30Tna0i9bz6cxaTA== X-IPAS-Result: A0BHAgAQb15q/4v/Ja1aglmCV3ReQ0mWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNVQImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAzIBGAEtEBwDAQIvKyMIGYMCAYJ0AxG7NBo3giyBAYMoAT8CQ1DbLgELFAEFgTOFP4ggXBgBhHwnGxuBcoEVg2mBBYFcAQEDgUWGXQSCInoSgVoeUI8pSIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4EMGwcFgR2BOoEChHQjHwM5f4EvdUp3LWkBEheBJoISAoE7AhMDCxgNSBEsNxQZBD5uB41BI4JAgQ4BExcBlT2SZaEPCiiDdYwhlToaM6psC5h9jgqWUIRpgWg8gUcLB3AVgyIJShkPjjiDa4F/gxTJRycyCzIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:Llr+qKkFwtatbRqN+uAhu4Xo5gzRJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJLWWyEOfreazOkLohzPI2w8BlU7ZXVyNM1TAA6qi0wRVtH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4E/raf658SUUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZC31GONgWYubDpLsfrb9nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FZQn4rlsDHhNz 90/AT0MdQuTwOGynq3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMiZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQUaz/7C7pm9AusrnXybTRes1KNjaE2+GPUigd21dABNfKII4bbGJ0JwhfwS mTuz3/nWC4Gb4SjzzPd8yOmlLHEjSrHcddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/E9lte5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:q4+hN6r0CChJbUUUvyeuPxEaV5rzeYIsimQD101hICG9vPb2qy nIpoV96faaslcssR0b9OxofZPwI080lqQFhbX5X43DYOCOggLBR+tfBMnZsljd8kbFmNK1u5 0NT0FWMqyXMbEDt7eY3CCIV/A93dKA7Kekwc3az3trUEVWTpsI1XYBNu5eeXcGPzWvwvECZe Kh2vY= X-Talos-CUID: 9a23:4y5P3mi6Exb5yvkzFCAVHDIb/DJua0LFk2zdOkyCKEFARbyOUk/X+6c6jJ87 X-Talos-MUID: 9a23:TgI4FQmFPl+r5KwTprwXdnpSL9ky3Lj1UHwLmM0H6sOWaydgMgu02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="512950449" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:53 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id D8C1318000203; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 3588FCC124B; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995 Date: Mon, 20 Jul 2026 11:57:46 -0700 Message-ID: <20260720185749.4098075-6-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241485 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-59995. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b [2] https://nvd.nist.gov/vuln/detail/CVE-2026-59995 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-59995.patch | 42 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch new file mode 100644 index 0000000000..9b6fee198f --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch @@ -0,0 +1,42 @@ +From b340eaa274a7e7dffea03bcb62169249bbddab37 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 29 Jun 2026 01:47:21 +0000 +Subject: [PATCH] upstream: avoid download to server-controlled path when + performing + +download on the commandline. From Swival scanner + +CVE: CVE-2026-59995 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b] + +Backport Changes: +- Retained the Scarthgap sftp.c OpenBSD revision identifier because the + 10.4 identifier does not describe the older source baseline. + +OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f +(cherry picked from commit 1b39f39657d2e58f8ec57341581a39bbf0be645b) +Signed-off-by: Devansh Patel +--- + sftp.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/sftp.c b/sftp.c +index c609b4153..487e53976 100644 +--- a/sftp.c ++++ b/sftp.c +@@ -2268,13 +2268,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2) + return (-1); + } + } else { +- /* XXX this is wrong wrt quoting */ +- snprintf(cmd, sizeof cmd, "get%s %s%s%s", +- global_aflag ? " -a" : "", dir, +- file2 == NULL ? "" : " ", +- file2 == NULL ? "" : file2); +- err = parse_dispatch_command(conn, cmd, +- &remote_path, startdir, 1, 0); ++ err = process_get(conn, dir, file2, remote_path, 0, 0, ++ global_aflag, 0); + free(dir); + free(startdir); + free(remote_path); diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index c2e172c8d6..b4885ab151 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -41,6 +41,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-59997.patch \ file://CVE-2026-59998.patch \ file://CVE-2026-59996.patch \ + file://CVE-2026-59995.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92945 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86944C44520 for ; Mon, 20 Jul 2026 18:58:01 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4969.1784573873556979391 for ; Mon, 20 Jul 2026 11:57:54 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=k0JqwPtU; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6306; q=dns/txt; s=iport01; t=1784573874; x=1785783474; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=dBCsEnDlRZ6W+N+aj+xuC6ztzmY6RntSIzWrwtNXXSs=; b=k0JqwPtUvHudxhLJLvM/pIeslwj8M8b2ga6xNEXCq69EPBXpk6/GJ9m/ zyzaLVBDDPTlvnow5NiK9QgjXfRUapHuX+YyNRsH7qilUbzN0JPjvYTFA wjhH150OWJnMIV5nBvOJgPfDtwPuGrn+32/6N+Jaex/zRa1sEiZhsWpFg FKEFRGko3GsBYf/jo7fR1KaE+v4W/J3vIX1t4fL7XGJGZULBwoQgTaIw7 KtC0zWirQPu0LVWOLv6TcWaNJGfnxXe/RAHAc+rSi0nkbw1Kz1XYCnh6x sKwZtwqtt3nFPHN/jeVDKmWMHuWcq5WtvnTkzBRyuDkXakuh5kAQs1Hu/ w==; X-CSE-ConnectionGUID: eAmkAk+mSVCzCj90ArWtCg== X-CSE-MsgGUID: BTj/VWDIR4Sr7j7pgHToKQ== X-IPAS-Result: A0BJAgAQb15q/5X/Ja1aglmCV3ReQ0mWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNVQImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAycLARgBLRAcAQIBAi8rHQYIGYMCAYJ0AxG8BYF5M4EBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FygRWCDIFdgQWBXAEBA4giBIIiehKBWh6PeUiBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBDBsHBYEdgTqBAoR0Ix8DOX+BL3VKdy1pARIXgSaCEgKBOwITAwsYDUgRLDcUGQQ+bgeNQSOCQIEECgETFwGCSJNbj16CIaEPCiiDdYwhlToaM6psC5h9jgqVNoEahGmBaDyBRwsHcBWDIglKGQ+OLQsLg2CBf4MUyUcnMgsyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:s+TmSaMUx+VSA7LvrR30lsFynXyQoLVcMsEvi/4bfWQNrUpxgj1Ux 2cWC2GPPqzbYjbzc9sgYYS+9klQ6JbSxtRkG3M5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeaphyFTmE+kvF3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WV7lV e/a+ZWFZgf6gWYsbAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6/hHCUIfPs4dwdhcE0pMp KQxMg8RRR/W0opawJrjIgVtrt4oIM+uOMYUvWttiGiDS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzPXwsYDUXUrsTIJ4zgu6unXnnWzZZs1mS46Ew5gA/ySQsieOxaoWMK4PiqcN9tHqa4 Vz500XDXioAa97A0TWlznWPv7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++NuUCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:HgDs0q9YKesPQYdaXoZuk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdg7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:BM+R0mhaQGJ9tip/tFlHP97KNDJuf1TYz17TYEqDN017Y7/EEXaKx79PnJ87 X-Talos-MUID: 9a23:9KDdMgQ0q9KAQwaoRXTGuDMlCvhEwp7yM1pSk8oetOm4Mg9JbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="513427197" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:53 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id DA6FC18000326; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 3A88ECC124C; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001 Date: Mon, 20 Jul 2026 11:57:47 -0700 Message-ID: <20260720185749.4098075-7-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241482 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-60001. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-60001 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 131 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch new file mode 100644 index 0000000000..ff1d14c7c9 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch @@ -0,0 +1,130 @@ +From ef41798b35a53757f8aa08ad14ee1463b0fe9b15 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 6 Jul 2026 07:44:48 +0000 +Subject: [PATCH] upstream: Fix cases in GSSAPI and keyboard-interactive + +authentication where the minimum per-attempt delay was not being enforced. + +Reported by Orange Cyberdefense Vulnerability Team + +CVE: CVE-2026-60001 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454] + +Backport Changes: +- Kept Scarthgap's PRIVSEP(ssh_gssapi_userok()) interface and GSSAPI + display-name recording while adding the upstream failure-delay calls; + mm_ssh_gssapi_userok() belongs to the later split-sshd architecture. +- Retained the Scarthgap OpenBSD revision identifiers in auth.h, + auth2-chall.c, auth2-gss.c, and auth2.c. + +OpenBSD-Commit-ID: c40bd35cc2428fcaccad7a141703c28baa6da01e +(cherry picked from commit d43ba60c91cb323ca921049b7d43b1908c318454) +Signed-off-by: Devansh Patel +--- + auth.h | 1 + + auth2-chall.c | 4 ++++ + auth2-gss.c | 7 +++++++ + auth2.c | 10 ++++++++-- + 4 files changed, 20 insertions(+), 2 deletions(-) + +diff --git a/auth.h b/auth.h +index 6d2d39762..9ad4898c5 100644 +--- a/auth.h ++++ b/auth.h +@@ -173,6 +173,7 @@ void auth_log(struct ssh *, int, int, const char *, const char *); + void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn)); + void userauth_finish(struct ssh *, int, const char *, const char *); + int auth_root_allowed(struct ssh *, const char *); ++void auth_failure_delay(Authctxt *, double); + + char *auth2_read_banner(void); + int auth2_methods_valid(const char *, int); +diff --git a/auth2-chall.c b/auth2-chall.c +index 021df8291..20e70d222 100644 +--- a/auth2-chall.c ++++ b/auth2-chall.c +@@ -296,6 +296,7 @@ input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh) + u_int i, nresp; + const char *devicename = NULL; + char **response = NULL; ++ double tstart = monotime_double(); + + if (authctxt == NULL) + fatal_f("no authctxt"); +@@ -354,6 +355,9 @@ input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh) + auth2_challenge_start(ssh); + } + } ++ ++ if (!authenticated) ++ auth_failure_delay(authctxt, tstart); + userauth_finish(ssh, authenticated, "keyboard-interactive", + devicename); + return 0; +diff --git a/auth2-gss.c b/auth2-gss.c +index f72a38998..195578bcf 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -255,6 +255,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) + Authctxt *authctxt = ssh->authctxt; + int r, authenticated; + const char *displayname; ++ double tstart = monotime_double(); + + if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + fatal("No authentication or GSSAPI context"); +@@ -268,6 +269,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh) + fatal_fr(r, "parse packet"); + + authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user)); ++ if (!authenticated) ++ auth_failure_delay(authctxt, tstart); + + if ((!use_privsep || mm_is_monitor()) && + (displayname = ssh_gssapi_displayname()) != NULL) +@@ -293,6 +296,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) + const char *displayname; + u_char *p; + size_t len; ++ double tstart = monotime_double(); + + if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + fatal("No authentication or GSSAPI context"); +@@ -320,6 +324,9 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh) + sshbuf_free(b); + free(mic.value); + ++ if (!authenticated) ++ auth_failure_delay(authctxt, tstart); ++ + if ((!use_privsep || mm_is_monitor()) && + (displayname = ssh_gssapi_displayname()) != NULL) + auth2_record_info(authctxt, "%s", displayname); +diff --git a/auth2.c b/auth2.c +index 271789a77..18077d625 100644 +--- a/auth2.c ++++ b/auth2.c +@@ -265,6 +265,12 @@ ensure_minimum_time_since(double start, double seconds) + nanosleep(&ts, NULL); + } + ++void ++auth_failure_delay(Authctxt *authctxt, double tstart) ++{ ++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user)); ++} ++ + static int + input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) + { +@@ -348,8 +354,8 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh) + authenticated = m->userauth(ssh, method); + } + if (!authctxt->authenticated && strcmp(method, "none") != 0) +- ensure_minimum_time_since(tstart, +- user_specific_delay(authctxt->user)); ++ auth_failure_delay(authctxt, tstart); ++ + userauth_finish(ssh, authenticated, method, NULL); + r = 0; + out: diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index b4885ab151..b15b909f60 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -42,6 +42,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-59998.patch \ file://CVE-2026-59996.patch \ file://CVE-2026-59995.patch \ + file://CVE-2026-60001.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92944 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08820C44515 for ; Mon, 20 Jul 2026 18:58:00 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4970.1784573873907972697 for ; Mon, 20 Jul 2026 11:57:54 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=DSec3PRR; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9714; q=dns/txt; s=iport01; t=1784573873; x=1785783473; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=lrCYyRxrB/jLwLvjp23EpnajJ2UinR/1YC8vN8xjpnA=; b=DSec3PRRjXBFuiGb/nd7uYt+eGQDz+gz5YRQEF/29O2HOA4gB+BmJOYV 77FAdNeSMF5vRVMl8hTV+CDF+2KQQH3ki6ewybf73jX4xhQCOAoBJ0vJ0 ZT/JroQKpK+JIrykFeAVuk10qXmUrNlYcqhPDsjuCQUxC6r2astrHtIb+ dIxI6/YIJisuONpCFP5NkuO/doYAGCg3yDLgALV9sQoj4N0FY8a38ZQUc Rws2JqZUg/jOnmJVIARtwPH1un9/9xTZZAowMyn8ZuvQuwDVo9Uqtacen 4TAo3yxT0N7SZHyDQMzrffW/3CfH65o1Fs7tK6x8gQUkcpr8yyrEpRNVa Q==; X-CSE-ConnectionGUID: e0DGomuOT5KZWoRBQKWi4g== X-CSE-MsgGUID: kjqcWq19Sp2RCEf4vPRwCA== X-IPAS-Result: A0BJAgCabl5q/4r/Ja1aglmCV3ReQ0mWSgOBE50IgX4PAQEBD0QNBAEBhD9GAo1VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDJwsBGAEtEBwDAQIXARcrIwgZGYJpAYJ0AxG8AYF5M4EBgygBPwJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FygRWCc3aBBYFcAQEDgUVgAoV7BIIiehKBWh6BWIIGjBtIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCEwMLGA1IESw3FBkEPm4HjUEjgkB/DwETFwGBGoEukxIRkjeBNZ9aCiiDdYwhjg2HLRozhVulEQuYfY4KllCEaYFoPIFHCwdwFYMiCUoZD44tCwuDYIF/gxTJRycyCzIBAQcCBw4DC4FokAKBfAEB IronPort-Data: A9a23:18HzeaxQt/LZcWJpYap6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkVVy GQeWWuDPK6NYWLyf9Ala4ni8h8H6JGGxtFrSgE4rlhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCea/VH1buSJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 46aT/H3Ygf/hWYraDpMtcpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJExuEaIf//tQPTxtx 8MfEho0TS+C2+3jldpXSsE07igiBNPgMIVavjRryivUSK5/B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bM3WjOX9PYH46tOulmHD5aD1AgFmUvqEwpWPUyWSd1ZCwaIaLJ4XTGpo9ckCwp WDf9FvgW0AhLIal4heLrmyUvPDktHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXy4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:zoIkgK2TcBH3+gh+PPM86gqjBGokLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WByB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFebvN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn5E4sLxKDwMeOGAbqBJbK ah2g== X-Talos-CUID: 9a23:8X4XP2FHW7nyTaK0qmJqrGI7HcU4VUGA70XvJHWSMEVWSeGaHAo= X-Talos-MUID: 9a23:WWiGZwg+PbfJiFFMduiPYMMpN8Vx6Ju3URE2ic88kOSKaTJIASi2pWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="504651177" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:53 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id DDB6F180001C7; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 404BECC124D; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002 Date: Mon, 20 Jul 2026 11:57:48 -0700 Message-ID: <20260720185749.4098075-8-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241484 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-60002. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-60002 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-60002.patch | 226 ++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 227 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch new file mode 100644 index 0000000000..9e94e77261 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch @@ -0,0 +1,226 @@ +From 767104acedd68c317b9d8fb603561e1a8be9e76a Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 6 Jul 2026 07:49:58 +0000 +Subject: [PATCH] upstream: fix ownership and lifetime of several bits of + client + +state that need to persist for the life of the connection, especially the +cached hostkey that was being incorrectly freed early on some paths, possibly +allowing its use after free. + +Reported by Zhenpeng (Leo) Lin from depthfirst.com + +CVE: CVE-2026-60002 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23] + +Backport Changes: +- Retained Scarthgap's valid_hostname() and valid_ruser() helpers when + relocating ssh_conn_info_free() from ssh.c to sshconnect.c. +- Retained Scarthgap's ext-info-c proposal handling while applying the + upstream connection-state ownership and lifetime changes. +- Retained the Scarthgap OpenBSD revision identifiers in ssh.c, + sshconnect.c, sshconnect.h, and sshconnect2.c. + +OpenBSD-Commit-ID: faaa6ad72e7d69d41fa8b197b606265b7d9bc73f +(cherry picked from commit e8bdfb151a356d0171fea4194dd205fbb252be23) +Signed-off-by: Devansh Patel +--- + ssh.c | 24 ++---------------------- + sshconnect.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-- + sshconnect.h | 7 +++++-- + sshconnect2.c | 20 +++++++++++--------- + 4 files changed, 63 insertions(+), 35 deletions(-) + +diff --git a/ssh.c b/ssh.c +index 9c49f98a8..aecdb79ea 100644 +--- a/ssh.c ++++ b/ssh.c +@@ -606,26 +606,6 @@ set_addrinfo_port(struct addrinfo *addrs, int port) + } + } + +-static void +-ssh_conn_info_free(struct ssh_conn_info *cinfo) +-{ +- if (cinfo == NULL) +- return; +- free(cinfo->conn_hash_hex); +- free(cinfo->shorthost); +- free(cinfo->uidstr); +- free(cinfo->keyalias); +- free(cinfo->thishost); +- free(cinfo->host_arg); +- free(cinfo->portstr); +- free(cinfo->remhost); +- free(cinfo->remuser); +- free(cinfo->homedir); +- free(cinfo->locuser); +- free(cinfo->jmphost); +- free(cinfo); +-} +- + static int + valid_hostname(const char *s) + { +@@ -1771,8 +1751,8 @@ main(int ac, char **av) + ssh_signal(SIGCHLD, main_sigchld_handler); + + /* Log into the remote system. Never returns if the login fails. */ +- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr, +- options.port, pw, timeout_ms, cinfo); ++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port, ++ pw, timeout_ms, cinfo); + + /* We no longer need the private host keys. Clear them now. */ + if (sensitive_data.nkeys != 0) { +diff --git a/sshconnect.c b/sshconnect.c +index bd077c75c..7823b6782 100644 +--- a/sshconnect.c ++++ b/sshconnect.c +@@ -83,6 +83,49 @@ extern char *__progname; + static int show_other_keys(struct hostkeys *, struct sshkey *); + static void warn_changed_key(struct sshkey *); + ++void ++ssh_conn_info_free(struct ssh_conn_info *cinfo) ++{ ++ if (cinfo == NULL) ++ return; ++ free(cinfo->conn_hash_hex); ++ free(cinfo->shorthost); ++ free(cinfo->uidstr); ++ free(cinfo->keyalias); ++ free(cinfo->thishost); ++ free(cinfo->host_arg); ++ free(cinfo->portstr); ++ free(cinfo->remhost); ++ free(cinfo->remuser); ++ free(cinfo->homedir); ++ free(cinfo->locuser); ++ free(cinfo->jmphost); ++ freezero(cinfo, sizeof(*cinfo)); ++} ++ ++struct ssh_conn_info * ++ssh_conn_info_dup(const struct ssh_conn_info *cinfo) ++{ ++ struct ssh_conn_info *ret; ++ ++ if (cinfo == NULL) ++ return NULL; ++ ret = xcalloc(1, sizeof(*ret)); ++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex); ++ ret->shorthost = xstrdup(cinfo->shorthost); ++ ret->uidstr = xstrdup(cinfo->uidstr); ++ ret->keyalias = xstrdup(cinfo->keyalias); ++ ret->thishost = xstrdup(cinfo->thishost); ++ ret->host_arg = xstrdup(cinfo->host_arg); ++ ret->portstr = xstrdup(cinfo->portstr); ++ ret->remhost = xstrdup(cinfo->remhost); ++ ret->remuser = xstrdup(cinfo->remuser); ++ ret->homedir = xstrdup(cinfo->homedir); ++ ret->locuser = xstrdup(cinfo->locuser); ++ ret->jmphost = xstrdup(cinfo->jmphost); ++ return ret; ++} ++ + /* Expand a proxy command */ + static char * + expand_proxy_command(const char *proxy_command, const char *user, +@@ -1559,8 +1602,8 @@ out: + */ + void + ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost, +- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms, +- const struct ssh_conn_info *cinfo) ++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw, ++ int timeout_ms, const struct ssh_conn_info *cinfo) + { + char *host; + char *server_user, *local_user; +diff --git a/sshconnect.h b/sshconnect.h +index 79d35cc19..da2a73f5a 100644 +--- a/sshconnect.h ++++ b/sshconnect.h +@@ -71,7 +71,7 @@ int ssh_connect(struct ssh *, const char *, const char *, + void ssh_kill_proxy_command(void); + + void ssh_login(struct ssh *, Sensitive *, const char *, +- struct sockaddr *, u_short, struct passwd *, int, ++ struct sockaddr_storage *, u_short, struct passwd *, int, + const struct ssh_conn_info *); + + int verify_host_key(char *, struct sockaddr *, struct sshkey *, +@@ -80,7 +80,7 @@ int verify_host_key(char *, struct sockaddr *, struct sshkey *, + void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short, + char **, char **); + +-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short, ++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short, + const struct ssh_conn_info *); + + void ssh_userauth2(struct ssh *ssh, const char *, const char *, +@@ -94,3 +94,6 @@ void maybe_add_key_to_agent(const char *, struct sshkey *, + void load_hostkeys_command(struct hostkeys *, const char *, + const char *, const struct ssh_conn_info *, + const struct sshkey *, const char *); ++ ++void ssh_conn_info_free(struct ssh_conn_info *); ++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *); +diff --git a/sshconnect2.c b/sshconnect2.c +index a296c9b8c..9efb3da8a 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -89,7 +89,7 @@ extern Options options; + */ + + static char *xxx_host; +-static struct sockaddr *xxx_hostaddr; ++static struct sockaddr_storage xxx_hostaddr; + static const struct ssh_conn_info *xxx_conn_info; + static int key_type_allowed(struct sshkey *, const char *); + +@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) + fatal("Server host key %s not in HostKeyAlgorithms", + sshkey_ssh_name(hostkey)); + } +- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, ++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey, + xxx_conn_info) != 0) + fatal("Host key verification failed."); + return 0; +@@ -222,16 +222,16 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port, + } + + void +-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, +- const struct ssh_conn_info *cinfo) ++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr, ++ u_short port, const struct ssh_conn_info *cinfo) + { + char *myproposal[PROPOSAL_MAX]; + char *s, *all_key, *hkalgs = NULL; + int r, use_known_hosts_order = 0; + +- xxx_host = host; +- xxx_hostaddr = hostaddr; +- xxx_conn_info = cinfo; ++ xxx_host = xstrdup(host); ++ xxx_hostaddr = *hostaddr; ++ xxx_conn_info = ssh_conn_info_dup(cinfo); + + if (options.rekey_limit || options.rekey_interval) + ssh_packet_set_rekey_limits(ssh, options.rekey_limit, +@@ -257,8 +257,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, + if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL) + fatal_f("kex_names_cat"); + +- if (use_known_hosts_order) +- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo); ++ if (use_known_hosts_order) { ++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr, ++ port, cinfo); ++ } + + kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers, + options.macs, compression_alg_list(options.compression), diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index b15b909f60..a6bf37d8a6 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -43,6 +43,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-59996.patch \ file://CVE-2026-59995.patch \ file://CVE-2026-60001.patch \ + file://CVE-2026-60002.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Mon Jul 20 18:57:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 92947 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5B5FC4452E for ; Mon, 20 Jul 2026 18:58:01 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4971.1784573873916483976 for ; Mon, 20 Jul 2026 11:57:54 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=d/L87+xo; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: devanshp@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6633; q=dns/txt; s=iport01; t=1784573873; x=1785783473; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=myl0BBIAXBx7anE8530D0P4aloFhiXrQoyoygNnP7yg=; b=d/L87+xokUCLffDeXB8Lx/6XS3WjDhqE1Hq9U7tlxpCeGLqBiV9Yw14G j50xmhSwHJpNTrJqmS2soeC+JIfj+83sM2h4t1f/l8ThSJhC/irH1eY2l AdADjy1tCOx+2fYHX0E33blxrSLvlLrwqbXh7kUQk5AmLanqg3UvDJyKZ EzzwjdkkbApc7vGQJacv+E8BHqWmnev4SW0P5dP8Z2GSUrjZiuwsOIMQS zQJ8gmtUFFNnpPSeqScgsVKzSQNb1KknbH93qNcKkpYnuAHygcWBUuU0L MHwbYGMjffMz/z+u+VjCnLI5HrjmadRptm/12fd/PatuKf8HbGChFiqhE A==; X-CSE-ConnectionGUID: CtjQU7vCQjeTLb4f4G1Xvw== X-CSE-MsgGUID: UPqfoC6LQ0aoAt9G/m5xhA== X-IPAS-Result: A0BIAgCabl5q/5P/Ja1aglmCV3ReQ0mWSgOeG4F+DwEBAQ9EDQQBAYQ/RgKNVQImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRvAGBeTOBAYMoAT8CQ1DbLgELFAEFgTOFP4ggXBgBhHwnGxuBcoEVgTuCLoEFgVwBAQOIIgSCInoSgVoej3lIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQwbBwWBHYE6gQKEdCMfAzl/gS91SnctaQESF4EmghICgTsCEwMLGA1IESw3FBkEPm4HjUEjgTxBMxBaIQkKARMXARc/JYECNRYGkwwRkjeBNZ9aCiiDdYwhlToaM6psC5h9jgqVNjILXYRpgWg8gUcLB3AVgyIJShkPji0LC4NggX+DFMlHJzILMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:NobtvKzKK6k4FCTSs0R6t+dmxyrEfRIJ4+MujC+fZmUNrF6WrkVSm GEWXDjXa/zfYjf0eoh3bo3g8B4DsJGGnN5hSVY6qlhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCea/VH1buSJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 46aT/H3Ygf/hWYraDpMtcpvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJGoqP7QlpfhcOGNDy dgSdD5RQUmzmf3jldpXSsE07igiBNPgMIVavjRryivUSK9+B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cPHWjOX9PYH46tOulmHD5aD1AgFmUvqEwpWPUyWSd1ZCxYYqLK4PVHZw9ckCwm 1rf8WPSXDUjbNWY4CbU3TWp2//PtHauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPAXi4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:NplStKucG1NVRlWiN4LwSCne7skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1NWZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:IyO1s2HdrYoo00MyqmJM6EwtJ587WUTfwUv0KRO2VUkweKOKHAo= X-Talos-MUID: 9a23:DZE7kwhfvWRG9ppWvH1d3sMpCf9x7aOFVmQ0yZwBktXVGmt1ZiedpWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,175,1779148800"; d="scan'208";a="498697701" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 20 Jul 2026 18:57:53 +0000 Received: from sjc-ads-9357.cisco.com (sjc-ads-9357.cisco.com [10.30.212.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id E410D18000241; Mon, 20 Jul 2026 18:57:52 +0000 (GMT) Received: by sjc-ads-9357.cisco.com (Postfix, from userid 1887503) id 453B9CC124E; Mon, 20 Jul 2026 11:57:52 -0700 (PDT) From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com, Devansh Patel Subject: [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000 Date: Mon, 20 Jul 2026 11:57:49 -0700 Message-ID: <20260720185749.4098075-9-devanshp@cisco.com> X-Mailer: git-send-email 2.44.4 In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com> References: <20260720185749.4098075-1-devanshp@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-9357.cisco.com [10.30.212.121];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.212.121, sjc-ads-9357.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 20 Jul 2026 18:58:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241481 From: Devansh Patel This patch applies the upstream OpenSSH 10.4 backport for CVE-2026-60000. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-60000 Signed-off-by: Devansh Patel --- .../openssh/openssh/CVE-2026-60000.patch | 140 ++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 141 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch new file mode 100644 index 0000000000..9c25786ced --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch @@ -0,0 +1,140 @@ +From 055316632809a2e2e58eac2020699b52187d1b11 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Mon, 6 Jul 2026 07:53:30 +0000 +Subject: [PATCH] upstream: Fix multiple RFC 4462 (GSSAPIAuthentication) + compliance + +problems + +1) Remove an early failure return for GSSAPI authentication attempts +made for invalid accounts that yielded different behaviour for +valid vs invalid accounts. + +2) Fix a situation where some GSSAPI requestes were not correctly +subjected to MaxAuthTries. + +3) Fix a moderate pre-authentication resource DoS related to #2. + +Add missing logging for error cases. + +Report and fixes from Manfred Kaiser, milCERT AT + +CVE: CVE-2026-60000 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192] + +Backport Changes: +- Kept Scarthgap's PRIVSEP(ssh_gssapi_server_ctx()) interface and its + authentication-context guard while applying the upstream RFC 4462 state, + failure, logging, and MaxAuthTries changes. +- Retained the Scarthgap auth2-gss.c OpenBSD revision identifier. + +OpenBSD-Commit-ID: ca0acdd64eea435d6f89534538a9eb404a5629d3 +(cherry picked from commit 5d04ca6af739b82fd30d84d2783ca802ebfa1192) +Signed-off-by: Devansh Patel +--- + auth2-gss.c | 53 ++++++++++++++++++++++++----------------------------- + 1 file changed, 24 insertions(+), 29 deletions(-) + +diff --git a/auth2-gss.c b/auth2-gss.c +index 195578bcf..6846eae5b 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -110,12 +110,6 @@ userauth_gssapi(struct ssh *ssh, const char *method) + return (0); + } + +- if (!authctxt->valid || authctxt->user == NULL) { +- debug2_f("disabled because of invalid user"); +- free(doid); +- return (0); +- } +- + if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) { + if (ctxt != NULL) + ssh_gssapi_delete_ctx(&ctxt); +@@ -177,8 +171,14 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh) + (r = sshpkt_send(ssh)) != 0) + fatal_fr(r, "send ERRTOK packet"); + } ++ logit("Failed gssapi-with-mic for %s%.100s " ++ "from %.200s port %d ssh2", ++ authctxt->valid ? "" : "invalid user ", ++ authctxt->user, ++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); + authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); ++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); + userauth_finish(ssh, 0, "gssapi-with-mic", NULL); + } else { + if (send_tok.length != 0) { +@@ -190,14 +190,18 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh) + fatal_fr(r, "send TOKEN packet"); + } + if (maj_status == GSS_S_COMPLETE) { +- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +- if (flags & GSS_C_INTEG_FLAG) +- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, ++ ssh_dispatch_set(ssh, ++ SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); ++ /* note: keep ERRTOK handler as per RFC 4462 s3.4 */ ++ if (flags & GSS_C_INTEG_FLAG) { ++ ssh_dispatch_set(ssh, ++ SSH2_MSG_USERAUTH_GSSAPI_MIC, + &input_gssapi_mic); +- else ++ } else { + ssh_dispatch_set(ssh, + SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, + &input_gssapi_exchange_complete); ++ } + } + } + +@@ -209,10 +213,6 @@ static int + input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh) + { + Authctxt *authctxt = ssh->authctxt; +- Gssctxt *gssctxt; +- gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER; +- gss_buffer_desc recv_tok; +- OM_uint32 maj_status; + int r; + u_char *p; + size_t len; +@@ -220,26 +220,21 @@ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh) + if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep)) + fatal("No authentication or GSSAPI context"); + +- gssctxt = authctxt->methoddata; +- if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 || ++ /* Minimal error handling - just cancel auth and return FAILURE */ ++ if ((r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0 || + (r = sshpkt_get_end(ssh)) != 0) + fatal_fr(r, "parse packet"); +- recv_tok.value = p; +- recv_tok.length = len; +- +- /* Push the error token into GSSAPI to see what it says */ +- maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok, +- &send_tok, NULL)); +- +- free(recv_tok.value); + +- /* We can't return anything to the client, even if we wanted to */ ++ logit("Failed gssapi-with-mic for %s%.100s from %.200s port %d ssh2", ++ authctxt->valid ? "" : "invalid user ", ++ authctxt->user, ++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); ++ authctxt->postponed = 0; + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL); +- +- /* The client will have already moved on to the next auth */ +- +- gss_release_buffer(&maj_status, &send_tok); ++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL); ++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL); ++ userauth_finish(ssh, 0, "gssapi-with-mic", NULL); + return 0; + } + diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index a6bf37d8a6..95c546489f 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -44,6 +44,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-59995.patch \ file://CVE-2026-60001.patch \ file://CVE-2026-60002.patch \ + file://CVE-2026-60000.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"