Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583
@ 2026-10-27 14:39 Fred Lefranc
  2026-10-29 12:10 ` Thomas Perale via buildroot
  0 siblings, 1 reply; 2+ messages in thread
From: Fred Lefranc @ 2026-10-27 14:39 UTC (permalink / raw)
  To: buildroot; +Cc: Fred Lefranc

From: Fred Lefranc <fred.lefranc+evs@gmail.com>

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

https://www.cve.org/CVERecord?id=CVE-2026-106583
Signed-off-by: Fred Lefranc <fred.lefranc+evs@gmail.com>
---
 package/openssh/0019-CVE-2026-106583.patch | 41 ++++++++++++++++++++++
 package/openssh/openssh.mk                 |  2 ++
 2 files changed, 43 insertions(+)
 create mode 100644 package/openssh/0019-CVE-2026-106583.patch

diff --git a/package/openssh/0019-CVE-2026-106583.patch b/package/openssh/0019-CVE-2026-106583.patch
new file mode 100644
index 0000000000..f116edf016
--- /dev/null
+++ b/package/openssh/0019-CVE-2026-106583.patch
@@ -0,0 +1,41 @@
+From 0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2 Mon Sep 17 00:00:00 2001
+From: "dtucker@openbsd.org" <dtucker@openbsd.org>
+Date: Mon, 5 Oct 2026 06:03:40 +0000
+Subject: [PATCH] upstream: Further restrict the characters allowed in a
+ command-line
+
+supplied user name, disallowing '$' and '\'. Reported by SecBuddyF KeenLab
+Tencent (CodeBuddy Security).
+
+Backport to OpenSSH 9.9p2 with the existing username validation patches:
+drop the OpenBSD revision update and rebase the functional hunk.
+
+OpenBSD-Commit-ID: 13671c178f492af63b5c1296f284818c7809ed9a
+CVE: CVE-2026-106583
+Upstream: https://github.com/openssh/openssh-portable/commit/0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2
+Signed-off-by: Copilot <223556219+Copilot@users.noreply.github.com>
+---
+ readconf.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/readconf.c b/readconf.c
+--- a/readconf.c
++++ b/readconf.c
+@@ -3319,14 +3319,11 @@ ssh_valid_ruser(const char *s)
+ 	for (i = 0; s[i] != 0; i++) {
+ 		if (iscntrl((u_char)s[i]))
+ 			return 0;
+-		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
++		if (strchr("'`\";&<>|(){}$\\", s[i]) != NULL)
+ 			return 0;
+ 		/* Disallow '-' after whitespace */
+ 		if (isspace((u_char)s[i]) && s[i + 1] == '-')
+ 			return 0;
+-		/* Disallow \ in last position */
+-		if (s[i] == '\\' && s[i + 1] == '\0')
+-			return 0;
+ 	}
+ 	return 1;
+ }
+-- 
+2.34.1
diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
index b3a4b0274d..29e29008d6 100644
--- a/package/openssh/openssh.mk
+++ b/package/openssh/openssh.mk
@@ -48,6 +48,8 @@ OPENSSH_IGNORE_CVES += CVE-2026-60000
 OPENSSH_IGNORE_CVES += CVE-2026-60001
 # 0018-CVE-2026-60002.patch
 OPENSSH_IGNORE_CVES += CVE-2026-60002
+# 0019-CVE-2026-106583.patch
+OPENSSH_IGNORE_CVES += CVE-2026-106583
 
 OPENSSH_CONF_ENV = \
 	LD="$(TARGET_CC)" \
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread
* Re: [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583
  2026-10-27 14:39 [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583 Fred Lefranc
@ 2026-10-29 12:10 ` Thomas Perale via buildroot
  0 siblings, 0 replies; 2+ messages in thread
From: Thomas Perale via buildroot @ 2026-10-29 12:10 UTC (permalink / raw)
  To: Fred Lefranc; +Cc: Thomas Perale, buildroot, Fred Lefranc

Hi Fred,

Thanks for the submission.

In reply of:
> In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
> 
> https://www.cve.org/CVERecord?id=CVE-2026-106583
> Signed-off-by: Fred Lefranc <fred.lefranc+evs@gmail.com>

> ---
>  package/openssh/0019-CVE-2026-106583.patch | 41 ++++++++++++++++++++++
>  package/openssh/openssh.mk                 |  2 ++
>  2 files changed, 43 insertions(+)
>  create mode 100644 package/openssh/0019-CVE-2026-106583.patch
> 
> diff --git a/package/openssh/0019-CVE-2026-106583.patch b/package/openssh/0019-CVE-2026-106583.patch
> new file mode 100644
> index 0000000000..f116edf016
> --- /dev/null
> +++ b/package/openssh/0019-CVE-2026-106583.patch
> @@ -0,0 +1,41 @@
> +From 0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2 Mon Sep 17 00:00:00 2001
> +From: "dtucker@openbsd.org" <dtucker@openbsd.org>
> +Date: Mon, 5 Oct 2026 06:03:40 +0000
> +Subject: [PATCH] upstream: Further restrict the characters allowed in a
> + command-line
> +
> +supplied user name, disallowing '$' and '\'. Reported by SecBuddyF KeenLab
> +Tencent (CodeBuddy Security).
> +
> +Backport to OpenSSH 9.9p2 with the existing username validation patches:
> +drop the OpenBSD revision update and rebase the functional hunk.
> +
> +OpenBSD-Commit-ID: 13671c178f492af63b5c1296f284818c7809ed9a
> +CVE: CVE-2026-106583
> +Upstream: https://github.com/openssh/openssh-portable/commit/0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2
> +Signed-off-by: Copilot <223556219+Copilot@users.noreply.github.com>

Can you confirm me you accept that I set your "Signed-off-by" here instead of
the 'copilot' one.

Best Regards,
PERALE Thomas

> +---
> + readconf.c | 5 +----
> + 1 file changed, 1 insertion(+), 4 deletions(-)
> +
> +diff --git a/readconf.c b/readconf.c
> +--- a/readconf.c
> ++++ b/readconf.c
> +@@ -3319,14 +3319,11 @@ ssh_valid_ruser(const char *s)
> + 	for (i = 0; s[i] != 0; i++) {
> + 		if (iscntrl((u_char)s[i]))
> + 			return 0;
> +-		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
> ++		if (strchr("'`\";&<>|(){}$\\", s[i]) != NULL)
> + 			return 0;
> + 		/* Disallow '-' after whitespace */
> + 		if (isspace((u_char)s[i]) && s[i + 1] == '-')
> + 			return 0;
> +-		/* Disallow \ in last position */
> +-		if (s[i] == '\\' && s[i + 1] == '\0')
> +-			return 0;
> + 	}
> + 	return 1;
> + }
> +-- 
> +2.34.1
> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
> index b3a4b0274d..29e29008d6 100644
> --- a/package/openssh/openssh.mk
> +++ b/package/openssh/openssh.mk
> @@ -48,6 +48,8 @@ OPENSSH_IGNORE_CVES += CVE-2026-60000
>  OPENSSH_IGNORE_CVES += CVE-2026-60001
>  # 0018-CVE-2026-60002.patch
>  OPENSSH_IGNORE_CVES += CVE-2026-60002
> +# 0019-CVE-2026-106583.patch
> +OPENSSH_IGNORE_CVES += CVE-2026-106583
>  
>  OPENSSH_CONF_ENV = \
>  	LD="$(TARGET_CC)" \
> -- 
> 2.34.1
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-29 12:11 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-27 14:39 [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583 Fred Lefranc
2026-10-29 12:10 ` Thomas Perale via buildroot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox