From: "Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" <devanshp@cisco.com>
To: openembedded-core@lists.openembedded.org
Cc: xe-linux-external@cisco.com, Devansh Patel <devanshp@cisco.com>
Subject: [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes
Date: Mon, 20 Jul 2026 11:57:41 -0700 [thread overview]
Message-ID: <20260720185749.4098075-1-devanshp@cisco.com> (raw)
From: Devansh Patel <devanshp@cisco.com>
This series backports security fixes from OpenSSH 10.4 to the OpenSSH
9.6p1 recipe in Scarthgap. The relevant upstream fixes are carried as
individual patches instead of upgrading the stable-branch recipe.
- CVE-2026-59995: Command-line SCP downloads could use a path controlled
by the server. Fixed by retaining the client-selected destination path
rather than allowing the server response to redirect the download.
Upstream: https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
- CVE-2026-59996: A remote glob could return ".." during remote-to-remote
copies and escape the expected path handling. Fixed by rejecting the
parent-directory result, matching the existing remote-to-local
protection.
Upstream: https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
- CVE-2026-59997: The internal-sftp server silently dropped command-line
arguments after the ninth argument. Fixed by passing the complete
argument vector to internal-sftp.
Upstream: https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
- CVE-2026-59998: Some environments require special consideration when
using GSSAPIStrictAcceptorCheck. Fixed by documenting the configuration
caveat in the upstream manual page.
Upstream: https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432
- CVE-2026-59999: DisableForwarding=yes did not override
PermitTunnel=yes. Fixed by including tunnel permission in the
DisableForwarding policy enforcement.
Upstream: https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
- CVE-2026-60000: Multiple RFC 4462 GSSAPI authentication issues caused
different behavior for valid and invalid accounts, incomplete
MaxAuthTries enforcement, and a moderate pre-authentication resource
denial of service. Fixed by aligning failure handling, applying attempt
limits consistently, and adding missing error logging.
Upstream: https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
- CVE-2026-60001: GSSAPI and keyboard-interactive authentication paths
did not always enforce the minimum per-attempt delay. Fixed by applying
the delay consistently to the affected authentication failures.
Upstream: https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
- CVE-2026-60002: Several pieces of client state had incorrect ownership
or lifetime, including a cached host key that could be freed too early
and subsequently used. Fixed by retaining connection-scoped state for
the full lifetime of the connection.
Upstream: https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
Each fix is kept in a separate commit for independent review and CVE
tracking. The OpenSSH recipe applies the patches in series order.
Validation:
- Built openssh successfully after applying the full series.
- Built core-image-minimal successfully with ptest packages enabled.
Devansh Patel (8):
openssh: Fix CVE-2026-59999
openssh: Fix CVE-2026-59997
openssh: Fix CVE-2026-59998
openssh: Fix CVE-2026-59996
openssh: Fix CVE-2026-59995
openssh: Fix CVE-2026-60001
openssh: Fix CVE-2026-60002
openssh: Fix CVE-2026-60000
.../openssh/openssh/CVE-2026-59995.patch | 42 ++++
.../openssh/openssh/CVE-2026-59996.patch | 37 +++
.../openssh/openssh/CVE-2026-59997.patch | 58 +++++
.../openssh/openssh/CVE-2026-59998.patch | 34 +++
.../openssh/openssh/CVE-2026-59999.patch | 36 +++
.../openssh/openssh/CVE-2026-60000.patch | 140 +++++++++++
.../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++
.../openssh/openssh/CVE-2026-60002.patch | 226 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 8 +
9 files changed, 711 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
--
2.44.4
next reply other threads:[~2026-07-20 18:58 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-20 18:57 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) [this message]
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260720185749.4098075-1-devanshp@cisco.com \
--to=devanshp@cisco.com \
--cc=openembedded-core@lists.openembedded.org \
--cc=xe-linux-external@cisco.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.