Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Fred Lefranc <fred.lefranc.evs@gmail.com>
To: buildroot@buildroot.org
Cc: Fred Lefranc <fred.lefranc+evs@gmail.com>
Subject: [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583
Date: Tue, 27 Oct 2026 15:39:01 +0100	[thread overview]
Message-ID: <20261027143901.402-1-fred.lefranc.evs@gmail.com> (raw)

From: Fred Lefranc <fred.lefranc+evs@gmail.com>

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

https://www.cve.org/CVERecord?id=CVE-2026-106583
Signed-off-by: Fred Lefranc <fred.lefranc+evs@gmail.com>
---
 package/openssh/0019-CVE-2026-106583.patch | 41 ++++++++++++++++++++++
 package/openssh/openssh.mk                 |  2 ++
 2 files changed, 43 insertions(+)
 create mode 100644 package/openssh/0019-CVE-2026-106583.patch

diff --git a/package/openssh/0019-CVE-2026-106583.patch b/package/openssh/0019-CVE-2026-106583.patch
new file mode 100644
index 0000000000..f116edf016
--- /dev/null
+++ b/package/openssh/0019-CVE-2026-106583.patch
@@ -0,0 +1,41 @@
+From 0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2 Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Mon, 5 Oct 2026 06:03:40 +0000
+Subject: [PATCH] upstream: Further restrict the characters allowed in a
+ command-line
+
+supplied user name, disallowing '$' and '\'. Reported by SecBuddyF KeenLab
+Tencent (CodeBuddy Security).
+
+Backport to OpenSSH 9.9p2 with the existing username validation patches:
+drop the OpenBSD revision update and rebase the functional hunk.
+
+OpenBSD-Commit-ID: 13671c178f492af63b5c1296f284818c7809ed9a
+CVE: CVE-2026-106583
+Upstream: https://github.com/openssh/openssh-portable/commit/0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2
+Signed-off-by: Copilot <223556219+Copilot@users.noreply.github.com>
+---
+ readconf.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/readconf.c b/readconf.c
+--- a/readconf.c
++++ b/readconf.c
+@@ -3319,14 +3319,11 @@ ssh_valid_ruser(const char *s)
+ 	for (i = 0; s[i] != 0; i++) {
+ 		if (iscntrl((u_char)s[i]))
+ 			return 0;
+-		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
++		if (strchr("'`\";&<>|(){}$\\", s[i]) != NULL)
+ 			return 0;
+ 		/* Disallow '-' after whitespace */
+ 		if (isspace((u_char)s[i]) && s[i + 1] == '-')
+ 			return 0;
+-		/* Disallow \ in last position */
+-		if (s[i] == '\\' && s[i + 1] == '\0')
+-			return 0;
+ 	}
+ 	return 1;
+ }
+-- 
+2.34.1
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index b3a4b0274d..29e29008d6 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -48,6 +48,8 @@ OPENSSH_IGNORE_CVES += CVE-2026-60000
 OPENSSH_IGNORE_CVES += CVE-2026-60001
 # 0018-CVE-2026-60002.patch
 OPENSSH_IGNORE_CVES += CVE-2026-60002
+# 0019-CVE-2026-106583.patch
+OPENSSH_IGNORE_CVES += CVE-2026-106583
 
 OPENSSH_CONF_ENV = \
 	LD="$(TARGET_CC)" \
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

             reply	other threads:[~2026-10-27 14:39 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27 14:39 Fred Lefranc [this message]
2026-10-29 12:10 ` [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583 Thomas Perale via buildroot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261027143901.402-1-fred.lefranc.evs@gmail.com \
    --to=fred.lefranc.evs@gmail.com \
    --cc=buildroot@buildroot.org \
    --cc=fred.lefranc+evs@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox