All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" <devanshp@cisco.com>
To: openembedded-core@lists.openembedded.org
Cc: xe-linux-external@cisco.com, Devansh Patel <devanshp@cisco.com>
Subject: [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes
Date: Mon, 20 Jul 2026 11:57:41 -0700	[thread overview]
Message-ID: <20260720185749.4098075-1-devanshp@cisco.com> (raw)

From: Devansh Patel <devanshp@cisco.com>

This series backports security fixes from OpenSSH 10.4 to the OpenSSH
9.6p1 recipe in Scarthgap. The relevant upstream fixes are carried as
individual patches instead of upgrading the stable-branch recipe.

- CVE-2026-59995: Command-line SCP downloads could use a path controlled
  by the server. Fixed by retaining the client-selected destination path
  rather than allowing the server response to redirect the download.
  Upstream: https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b

- CVE-2026-59996: A remote glob could return ".." during remote-to-remote
  copies and escape the expected path handling. Fixed by rejecting the
  parent-directory result, matching the existing remote-to-local
  protection.
  Upstream: https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78

- CVE-2026-59997: The internal-sftp server silently dropped command-line
  arguments after the ninth argument. Fixed by passing the complete
  argument vector to internal-sftp.
  Upstream: https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014

- CVE-2026-59998: Some environments require special consideration when
  using GSSAPIStrictAcceptorCheck. Fixed by documenting the configuration
  caveat in the upstream manual page.
  Upstream: https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432

- CVE-2026-59999: DisableForwarding=yes did not override
  PermitTunnel=yes. Fixed by including tunnel permission in the
  DisableForwarding policy enforcement.
  Upstream: https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753

- CVE-2026-60000: Multiple RFC 4462 GSSAPI authentication issues caused
  different behavior for valid and invalid accounts, incomplete
  MaxAuthTries enforcement, and a moderate pre-authentication resource
  denial of service. Fixed by aligning failure handling, applying attempt
  limits consistently, and adding missing error logging.
  Upstream: https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192

- CVE-2026-60001: GSSAPI and keyboard-interactive authentication paths
  did not always enforce the minimum per-attempt delay. Fixed by applying
  the delay consistently to the affected authentication failures.
  Upstream: https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454

- CVE-2026-60002: Several pieces of client state had incorrect ownership
  or lifetime, including a cached host key that could be freed too early
  and subsequently used. Fixed by retaining connection-scoped state for
  the full lifetime of the connection.
  Upstream: https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23

Each fix is kept in a separate commit for independent review and CVE
tracking. The OpenSSH recipe applies the patches in series order.

Validation:
- Built openssh successfully after applying the full series.
- Built core-image-minimal successfully with ptest packages enabled.

Devansh Patel (8):
  openssh: Fix CVE-2026-59999
  openssh: Fix CVE-2026-59997
  openssh: Fix CVE-2026-59998
  openssh: Fix CVE-2026-59996
  openssh: Fix CVE-2026-59995
  openssh: Fix CVE-2026-60001
  openssh: Fix CVE-2026-60002
  openssh: Fix CVE-2026-60000

 .../openssh/openssh/CVE-2026-59995.patch      |  42 ++++
 .../openssh/openssh/CVE-2026-59996.patch      |  37 +++
 .../openssh/openssh/CVE-2026-59997.patch      |  58 +++++
 .../openssh/openssh/CVE-2026-59998.patch      |  34 +++
 .../openssh/openssh/CVE-2026-59999.patch      |  36 +++
 .../openssh/openssh/CVE-2026-60000.patch      | 140 +++++++++++
 .../openssh/openssh/CVE-2026-60001.patch      | 130 ++++++++++
 .../openssh/openssh/CVE-2026-60002.patch      | 226 ++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |   8 +
 9 files changed, 711 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch

-- 
2.44.4



             reply	other threads:[~2026-07-20 18:58 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-20 18:57 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) [this message]
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260720185749.4098075-1-devanshp@cisco.com \
    --to=devanshp@cisco.com \
    --cc=openembedded-core@lists.openembedded.org \
    --cc=xe-linux-external@cisco.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.