Re: [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583

From: Thomas Perale via buildroot <buildroot@buildroot.org>
To: Fred Lefranc <fred.lefranc.evs@gmail.com>
Cc: Thomas Perale <thomas.perale@mind.be>,
	buildroot@buildroot.org,
	Fred Lefranc <fred.lefranc+evs@gmail.com>
Subject: Re: [Buildroot] [PATCH 2025.02.x] package/openssh: fix CVE-2026-106583
Date: Thu, 29 Oct 2026 13:10:52 +0100	[thread overview]
Message-ID: <20261029121052.199693-1-thomas.perale@mind.be> (raw)
In-Reply-To: <20261027143901.402-1-fred.lefranc.evs@gmail.com>

Hi Fred,

Thanks for the submission.

In reply of:
> In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
> 
> https://www.cve.org/CVERecord?id=CVE-2026-106583
> Signed-off-by: Fred Lefranc <fred.lefranc+evs@gmail.com>

> ---
>  package/openssh/0019-CVE-2026-106583.patch | 41 ++++++++++++++++++++++
>  package/openssh/openssh.mk                 |  2 ++
>  2 files changed, 43 insertions(+)
>  create mode 100644 package/openssh/0019-CVE-2026-106583.patch
> 
> diff --git a/package/openssh/0019-CVE-2026-106583.patch b/package/openssh/0019-CVE-2026-106583.patch
> new file mode 100644
> index 0000000000..f116edf016
> --- /dev/null
> +++ b/package/openssh/0019-CVE-2026-106583.patch
> @@ -0,0 +1,41 @@
> +From 0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2 Mon Sep 17 00:00:00 2001
> +From: "dtucker@openbsd.org" <dtucker@openbsd.org>
> +Date: Mon, 5 Oct 2026 06:03:40 +0000
> +Subject: [PATCH] upstream: Further restrict the characters allowed in a
> + command-line
> +
> +supplied user name, disallowing '$' and '\'. Reported by SecBuddyF KeenLab
> +Tencent (CodeBuddy Security).
> +
> +Backport to OpenSSH 9.9p2 with the existing username validation patches:
> +drop the OpenBSD revision update and rebase the functional hunk.
> +
> +OpenBSD-Commit-ID: 13671c178f492af63b5c1296f284818c7809ed9a
> +CVE: CVE-2026-106583
> +Upstream: https://github.com/openssh/openssh-portable/commit/0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2
> +Signed-off-by: Copilot <223556219+Copilot@users.noreply.github.com>

Can you confirm me you accept that I set your "Signed-off-by" here instead of
the 'copilot' one.

Best Regards,
PERALE Thomas

> +---
> + readconf.c | 5 +----
> + 1 file changed, 1 insertion(+), 4 deletions(-)
> +
> +diff --git a/readconf.c b/readconf.c
> +--- a/readconf.c
> ++++ b/readconf.c
> +@@ -3319,14 +3319,11 @@ ssh_valid_ruser(const char *s)
> + 	for (i = 0; s[i] != 0; i++) {
> + 		if (iscntrl((u_char)s[i]))
> + 			return 0;
> +-		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
> ++		if (strchr("'`\";&<>|(){}$\\", s[i]) != NULL)
> + 			return 0;
> + 		/* Disallow '-' after whitespace */
> + 		if (isspace((u_char)s[i]) && s[i + 1] == '-')
> + 			return 0;
> +-		/* Disallow \ in last position */
> +-		if (s[i] == '\\' && s[i + 1] == '\0')
> +-			return 0;
> + 	}
> + 	return 1;
> + }
> +-- 
> +2.34.1
> diff --git a/package/openssh/openssh.mk b/package/openssh/openssh.mk
> index b3a4b0274d..29e29008d6 100644
> --- a/package/openssh/openssh.mk
> +++ b/package/openssh/openssh.mk
> @@ -48,6 +48,8 @@ OPENSSH_IGNORE_CVES += CVE-2026-60000
>  OPENSSH_IGNORE_CVES += CVE-2026-60001
>  # 0018-CVE-2026-60002.patch
>  OPENSSH_IGNORE_CVES += CVE-2026-60002
> +# 0019-CVE-2026-106583.patch
> +OPENSSH_IGNORE_CVES += CVE-2026-106583
>  
>  OPENSSH_CONF_ENV = \
>  	LD="$(TARGET_CC)" \
> -- 
> 2.34.1
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot