* Re: [OE-core][scarthgap][PATCH] libxpm: upgrade 3.5.17 -> 3.5.19
From: Ng, Enoch @ 2026-07-20 22:38 UTC (permalink / raw)
To: Yoann Congal, openembedded-core@lists.openembedded.org
In-Reply-To: <DK38U8J7M0EP.H6R91H3OQ454@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 3694 bytes --]
Hi Yoann, thank you for your feedback.
> I disagree: 3.5.18 is a maintenance/cleanup release with major code
> removal (even if obsolete) and I think this is not compatible with our
> stable policy.
>
> To fix CVE-2026-4367, you should backport the fix to scarthgap instead.
Understood. I will submit a new patch to backport the fix from upstream libxpm to scarthgap.
Thanks,
Enoch Ng
Wind River Linux
________________________________
From: Yoann Congal <yoann.congal@smile.fr>
Sent: Monday, July 20, 2026 3:08 AM
To: Ng, Enoch <Enoch.Ng@windriver.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][scarthgap][PATCH] libxpm: upgrade 3.5.17 -> 3.5.19
CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.
Hello,
On Thu Jul 16, 2026 at 4:25 PM CEST, Enoch Ng via lists.openembedded.org wrote:
> From: Wang Mingyu <wangmy@fujitsu.com>
>
> Squashed backport of two upgrades:
> 1fc25a668e libxpm: upgrade 3.5.18 -> 3.5.19
> 767f686226 libxpm: upgrade 3.5.17 -> 3.5.18
Wang did not author this squashed commit. You can reference their
commits but if you majorly modify them (like here), you should be
author.
>
> A vulnerability in the `xpmNextWord()` function could cause an
> internal pointer to read beyond the file's end due to improper
> validation of file boundaries. This issue was fixed in libXpm 3.5.19.
>
> The changes between 3.5.17 and 3.5.19 contain the fix to
> CVE-2026-4367 along with other changes that should be safe to
> backport as shown here:
>
> $ git log --oneline libXpm-3.5.17..libXpm-3.5.19
> 9a05472 (HEAD -> master, tag: libXpm-3.5.19, origin/master,
> origin/HEAD) libXpm 3.5.19
> 5448e1b Fix CVE-2026-4367: Out-of-bounds read in xpmNextWord()
> 5b7e903 (tag: libXpm-3.5.18) libXpm 3.5.18
> a5549ac gitlab CI: drop the ci-fairy check-mr job
> 10070a4 Strip trailing whitespace from source files
> 5679dd6 tests: poll for stable compressed output
> 7ce3959 man pages: adjust line breaks in source files
> 60ee362 man pages: remove .PP after .SH or .SS lines
> 3ba5d81 man pages: ensure .BR macro has multiple arguments
> 3aa8a1e man pages: make indentation arguments to .IP be numeric
> 854c23a XpmCreateBuffer.3: editorial changes for this man page
> [Debian bug #1102886]
> b7309b4 Fix build with current Windows headers
> 2803929 Use _stricmp() instead of strcasecmp() on Windows
> bdb6c75 Remove xpmstrdup fallback for strdup
> 73b69d7 Remove xpmstrcasecmp fallback for strcasecmp
> b30fd09 Remove ancient port to 16-bit Windows without X11 libraries
> 0224b43 Remove ancient Amiga support
> b72af4e unifdef VAX11C
> 02702c2 unifdef sequent
> b4e2177 Remove outdated ifdef checks for including stdint.h
I disagree: 3.5.18 is a maintenance/cleanup release with major code
removal (even if obsolete) and I think this is not compatible with our
stable policy.
To fix CVE-2026-4367, you should backport the fix to scarthgap instead.
>
> Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> Signed-off-by: Ross Burton <ross.burton@arm.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
> ---
> .../xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} (88%)
Regards,
--
Yoann Congal
Smile ECS
[-- Attachment #2: Type: text/html, Size: 7437 bytes --]
^ permalink raw reply
* [OE-core][PATCH] documentation: Update documentation for SPDX License expressions
From: Joshua Watt @ 2026-07-20 20:57 UTC (permalink / raw)
To: openembedded-core; +Cc: Joshua Watt
Updates the variable documentation to indicate that they now deal with
SPDX License identifier and expressions.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
meta/conf/documentation.conf | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/meta/conf/documentation.conf b/meta/conf/documentation.conf
index 842cf31739..1a6ec8fdd5 100644
--- a/meta/conf/documentation.conf
+++ b/meta/conf/documentation.conf
@@ -214,7 +214,8 @@ IMAGE_ROOTFS_EXTRA_SPACE[doc] = "Defines additional free disk space created in t
IMAGE_ROOTFS_MAXSIZE[doc] = "Defines the maximum size in Kbytes for the generated image."
IMAGE_ROOTFS_SIZE[doc] = "Defines the size in Kbytes for the generated image."
IMAGE_TYPES[doc] = "Specifies the complete list of supported image types by default."
-INCOMPATIBLE_LICENSE[doc] = "Specifies a space-separated list of license names (as they would appear in LICENSE) that should be excluded from the build. Wildcard is supported, such as '*GPL-3.0*'"
+INCOMPATIBLE_LICENSE[doc] = "Specifies a space-separated list of SPDX Licenses or SPDX Exceptions (as they would appear in LICENSE) that should be excluded from the build. Wildcard is supported, such as '*GPL-3.0*'"
+INCOMPATIBLE_LICENSE_EXCEPTIONS[doc] = "Specifies a space-separated list of SPDX Licenses or SPDX Exceptions (as they would appear in LICENSE) that should be allowed in the build, even if they would otherwise match INCOMPATIBLE_LICENSE"
INHIBIT_DEFAULT_DEPS[doc] = "Prevents the default dependencies, namely the C compiler and standard C library (libc), from being added to DEPENDS."
INHIBIT_PACKAGE_STRIP[doc] = "If set to "1", causes the build to not strip binaries in resulting packages."
INHERIT[doc] = "Causes the named class to be inherited at this point during parsing. The variable is only valid in configuration files."
@@ -254,7 +255,7 @@ LAYERDIR[doc] = "When used inside the layer.conf configuration file, this variab
LAYERVERSION[doc] = "Optionally specifies the version of a layer as a single number. This variable is used in the conf/layer.conf file and must be suffixed with the name of the specific layer."
LEAD_SONAME[doc] = "Specifies the lead (or primary) compiled library file (.so) that the debian class applies its naming policy to given a recipe that packages multiple libraries."
LIC_FILES_CHKSUM[doc] = "Checksums of the license text in the recipe source code."
-LICENSE[doc] = "The list of source licenses for the recipe. Logical operators '&' or '|' and parentheses can be used."
+LICENSE[doc] = "The source license for the recipe as a SPDX License expression"
LICENSE_FLAGS[doc] = "List of commercial or other special licensing terms which must be explicitly approved through LICENSE_FLAGS_ACCEPTED."
LICENSE_FLAGS_ACCEPTED[doc] = "List of accepted licensing terms matching LICENSE_FLAGS."
LICENSE_FLAGS_DETAILS[doc] = "Gives more details about a specific license found in LICENSE_FLAGS."
--
2.54.0
^ permalink raw reply related
* [OE-core][PATCH v3] gcc: Update license
From: Joshua Watt @ 2026-07-20 20:49 UTC (permalink / raw)
To: openembedded-core; +Cc: Joshua Watt
In-Reply-To: <20260715164739.364323-10-JPEWhacker@gmail.com>
GPL-3.0-with-GCC-exception is a deprecated license ID, so replace it
with "GPL-3.0-or-later WITH GCC-exception-3.1".
Also, the LICENSE expression in gcc.inc appears to be incomplete,
missing GPL-2.0-or-later, LGPL-2.1-or-later, and LGPL-3.0-or-later, even
though the checksums for their corresponding license files are clearly
checked in LIC_FILES_CHKSUM.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
---
meta/recipes-devtools/gcc/gcc-16.1.inc | 2 +-
meta/recipes-devtools/gcc/gcc-runtime.inc | 4 ++--
meta/recipes-devtools/gcc/libgcc-initial.inc | 2 +-
meta/recipes-devtools/gcc/libgcc.inc | 8 ++++----
meta/recipes-devtools/gcc/libgfortran.inc | 6 +++---
5 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/meta/recipes-devtools/gcc/gcc-16.1.inc b/meta/recipes-devtools/gcc/gcc-16.1.inc
index 4598aff045..e2be559f19 100644
--- a/meta/recipes-devtools/gcc/gcc-16.1.inc
+++ b/meta/recipes-devtools/gcc/gcc-16.1.inc
@@ -16,7 +16,7 @@ TOOLCHAIN_NATIVE = "gcc"
DEPENDS =+ "mpfr gmp libmpc zlib zstd flex-native"
NATIVEDEPS = "mpfr-native gmp-native libmpc-native zlib-native flex-native zstd-native"
-LICENSE = "GPL-3.0-with-GCC-exception & GPL-3.0-only"
+LICENSE = "GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later AND GPL-3.0-or-later WITH GCC-exception-3.1 AND LGPL-3.0-or-later"
LIC_FILES_CHKSUM = "\
file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \
diff --git a/meta/recipes-devtools/gcc/gcc-runtime.inc b/meta/recipes-devtools/gcc/gcc-runtime.inc
index d58cbe9c1a..5dbc10031a 100644
--- a/meta/recipes-devtools/gcc/gcc-runtime.inc
+++ b/meta/recipes-devtools/gcc/gcc-runtime.inc
@@ -4,11 +4,11 @@ SUMMARY = "Runtime libraries from GCC"
# Over-ride the LICENSE set by gcc-${PV}.inc to remove "& GPLv3"
# All gcc-runtime packages are now covered by the runtime exception.
-LICENSE = "GPL-3.0-with-GCC-exception"
+LICENSE = "GPL-3.0-or-later WITH GCC-exception-3.1"
CXXFLAGS:remove = "-fvisibility-inlines-hidden"
CFLAGS:append = " -Wno-error=discarded-qualifiers"
-
+
EXTRA_OECONF_PATHS = "\
--with-gxx-include-dir=${includedir}/c++/${BINV} \
--with-sysroot=/not/exist \
diff --git a/meta/recipes-devtools/gcc/libgcc-initial.inc b/meta/recipes-devtools/gcc/libgcc-initial.inc
index ce100d7ddc..d067f7eb00 100644
--- a/meta/recipes-devtools/gcc/libgcc-initial.inc
+++ b/meta/recipes-devtools/gcc/libgcc-initial.inc
@@ -31,7 +31,7 @@ require libgcc-common.inc
DEPENDS = "virtual/cross-cc"
-LICENSE = "GPL-3.0-with-GCC-exception"
+LICENSE = "GPL-3.0-or-later WITH GCC-exception-3.1"
PACKAGES = ""
diff --git a/meta/recipes-devtools/gcc/libgcc.inc b/meta/recipes-devtools/gcc/libgcc.inc
index 74e8746b42..e92dadf021 100644
--- a/meta/recipes-devtools/gcc/libgcc.inc
+++ b/meta/recipes-devtools/gcc/libgcc.inc
@@ -32,10 +32,10 @@ PACKAGES = "\
# All libgcc source is marked with the exception.
#
-LICENSE:${PN} = "GPL-3.0-with-GCC-exception"
-LICENSE:${PN}-dev = "GPL-3.0-with-GCC-exception"
-LICENSE:${PN}-dbg = "GPL-3.0-with-GCC-exception"
-LICENSE:${PN}-src = "GPL-3.0-with-GCC-exception"
+LICENSE:${PN} = "GPL-3.0-or-later WITH GCC-exception-3.1"
+LICENSE:${PN}-dev = "GPL-3.0-or-later WITH GCC-exception-3.1"
+LICENSE:${PN}-dbg = "GPL-3.0-or-later WITH GCC-exception-3.1"
+LICENSE:${PN}-src = "GPL-3.0-or-later WITH GCC-exception-3.1"
FILES:${PN}-dev = "\
${base_libdir}/libgcc*.so \
diff --git a/meta/recipes-devtools/gcc/libgfortran.inc b/meta/recipes-devtools/gcc/libgfortran.inc
index fa6aecaaa3..1726b40c6a 100644
--- a/meta/recipes-devtools/gcc/libgfortran.inc
+++ b/meta/recipes-devtools/gcc/libgfortran.inc
@@ -60,9 +60,9 @@ PACKAGES = "\
libgfortran-staticdev \
"
-LICENSE:${PN} = "GPL-3.0-with-GCC-exception"
-LICENSE:${PN}-dev = "GPL-3.0-with-GCC-exception"
-LICENSE:${PN}-dbg = "GPL-3.0-with-GCC-exception"
+LICENSE:${PN} = "GPL-3.0-or-later WITH GCC-exception-3.1"
+LICENSE:${PN}-dev = "GPL-3.0-or-later WITH GCC-exception-3.1"
+LICENSE:${PN}-dbg = "GPL-3.0-or-later WITH GCC-exception-3.1"
FILES:${PN} = "${libdir}/libgfortran.so.*"
FILES:${PN}-dev = "\
--
2.54.0
^ permalink raw reply related
* [PATCH 2/2] classes/cargo: remove BUILD_MODE, replace with CARGO_PROFILE
From: Ross Burton @ 2026-07-20 19:45 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <20260720194510.3193319-1-ross.burton@arm.com>
The BUILD_MODE variable appears to be a way to select the Cargo build profile
that is used, but it can't be assigned because it and other pieces of
code base their logic on the value of DEBUG_BUILD.
Instead of a BUILD_MODE variable that is "--release" or "" depending on
the value of DEBUG_BUILD, replace it with a clear CARGO_PROFILE variable
that selects the profile to use. The default has the same behaviour as before:
either "release" or "dev" based on DEBUG_BUILD.
This profile is then passed to cargo, and used to construct paths in the
build tree (with the caveat that the "dev" profile puts files in "debug").
[1] https://doc.rust-lang.org/cargo/reference/profiles.html
Signed-off-by: Ross Burton <ross.burton@arm.com>
---
meta/classes-recipe/cargo.bbclass | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/meta/classes-recipe/cargo.bbclass b/meta/classes-recipe/cargo.bbclass
index 8e05a820af4..b34f3ce0cd7 100644
--- a/meta/classes-recipe/cargo.bbclass
+++ b/meta/classes-recipe/cargo.bbclass
@@ -31,18 +31,28 @@ B = "${WORKDIR}/build"
export RUST_BACKTRACE = "1"
RUSTFLAGS ??= ""
-BUILD_MODE = "${@['--release', ''][d.getVar('DEBUG_BUILD') == '1']}"
+
+# The cargo profile to use. Defaults to release or dev based on DEBUG_BUILD, but
+# can be set to any valid profile.
+# https://doc.rust-lang.org/cargo/reference/profiles.html
+CARGO_PROFILE ?= "${@oe.utils.vartrue('DEBUG_BUILD', 'dev', 'release', d)}"
+
# --frozen flag will prevent network access (which is required since only
# the do_fetch step is authorized to access network)
# and will require an up to date Cargo.lock file.
# This force the package being built to already ship a Cargo.lock, in the end
# this is what we want, at least, for reproducibility of the build.
-CARGO_BUILD_FLAGS = "-v --frozen --target ${RUST_HOST_SYS} ${BUILD_MODE} --manifest-path=${CARGO_MANIFEST_PATH}"
+CARGO_BUILD_FLAGS = "-v --frozen --target ${RUST_HOST_SYS} --profile=${CARGO_PROFILE} --manifest-path=${CARGO_MANIFEST_PATH}"
+
+# The build directory is named after the profile, apart from the dev profile
+# which uses 'debug'.
+def cargo_build_directory(d):
+ profile = d.getVar("CARGO_PROFILE")
+ return "debug" if profile == "dev" else profile
+BUILD_DIR = "${@cargo_build_directory(d)}"
-# This is based on the content of CARGO_BUILD_FLAGS and generally will need to
-# change if CARGO_BUILD_FLAGS changes.
-BUILD_DIR = "${@['release', 'debug'][d.getVar('DEBUG_BUILD') == '1']}"
CARGO_TARGET_SUBDIR = "${RUST_HOST_SYS}/${BUILD_DIR}"
+
oe_cargo_build () {
export RUSTFLAGS="${RUSTFLAGS}"
bbnote "Using rust targets from ${RUST_TARGET_PATH}"
--
2.43.0
^ permalink raw reply related
* [PATCH 1/2] classes/cargo: fix indentation
From: Ross Burton @ 2026-07-20 19:45 UTC (permalink / raw)
To: openembedded-core
Fix mismatching indentation.
Signed-off-by: Ross Burton <ross.burton@arm.com>
---
meta/classes-recipe/cargo.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes-recipe/cargo.bbclass b/meta/classes-recipe/cargo.bbclass
index 2dd28e95d33..8e05a820af4 100644
--- a/meta/classes-recipe/cargo.bbclass
+++ b/meta/classes-recipe/cargo.bbclass
@@ -61,7 +61,7 @@ cargo_do_install () {
for tgt in "${B}/target/${CARGO_TARGET_SUBDIR}/"*; do
case $tgt in
*.so|*.rlib)
- if [ -n "${CARGO_INSTALL_LIBRARIES}" ]; then
+ if [ -n "${CARGO_INSTALL_LIBRARIES}" ]; then
install -d "${D}${rustlibdir}"
install -m755 "$tgt" "${D}${rustlibdir}"
have_installed=true
--
2.43.0
^ permalink raw reply related
* Re: [OE-core][scarthgap 13/33] dropbear: Disable DSS correctly
From: Paul Barker @ 2026-07-20 19:35 UTC (permalink / raw)
To: yoann.congal, openembedded-core; +Cc: Mike Crowe
In-Reply-To: <56f5e0e276a5f39e5ae7fb9e61a4ef64aa51bd7e.1784567958.git.yoann.congal@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 734 bytes --]
On Mon, 2026-07-20 at 19:22 +0200, Yoann Congal via
lists.openembedded.org wrote:
> From: Mike Crowe <mac@mcrowe.com>
>
> Take upstream patch that stops sysoptions.h unconditionally turning
> DROPBEAR_DSS back on even when it has been disabled (which is the
> default).
>
> Signed-off-by: Mike Crowe <mac@mcrowe.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Hi Mike, Yoann,
It looks like we've been building dropbear with DSS support enabled for
the life of the scarthgap release until now, due to a bug in the
assignment of DROPBEAR_DSS. Fixing this now will forcibly disable DSS
support for all users, which is not something we should do on a stable
branch.
Best regards,
--
Paul Barker
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]
^ permalink raw reply
* Re: [OE-core][scarthgap 12/33] bzip2: fix 'bzip2 --version > /tmp/aaa 2>&1' hang
From: Paul Barker @ 2026-07-20 19:14 UTC (permalink / raw)
To: yoann.congal, openembedded-core; +Cc: Jaipaul Cheernam
In-Reply-To: <4e5d0d595f713a4a5cff72f389aa9cac07fe5d14.1784567958.git.yoann.congal@smile.fr>
[-- Attachment #1: Type: text/plain, Size: 1565 bytes --]
On Mon, 2026-07-20 at 19:22 +0200, Yoann Congal via
lists.openembedded.org wrote:
> From: Hongxu Jia <hongxu.jia@windriver.com>
>
> According to [1]
>
> As of the current version 1.0.8, bzip2 --version will print version
> info but it will also continue compressing stdin:
>
> $ ./bzip2 --version
> bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019.
>
> Copyright (C) 1996-2019 by Julian Seward.
>
> This program is free software; [...]
>
> bzip2: I won't write compressed data to a terminal.
> bzip2: For help, type: `bzip2 --help'.
>
> Debian (and its downstreams like Ubuntu) will patch this out [2],
> making the < /dev/null unnecessary, port a part of debian patch
> to fix the issue
>
> [1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2
> [2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/
>
> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> (cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b)
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Hi Jaipaul,
What's the motivation for backporting this now? Applying this to
scarthgap will change the behaviour of bzip2 on a stable branch, so we'd
need a strong reason to do that.
Best regards,
--
Paul Barker
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]
^ permalink raw reply
* [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59995. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59995
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59995.patch | 42 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 43 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
new file mode 100644
index 0000000000..9b6fee198f
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
@@ -0,0 +1,42 @@
+From b340eaa274a7e7dffea03bcb62169249bbddab37 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 29 Jun 2026 01:47:21 +0000
+Subject: [PATCH] upstream: avoid download to server-controlled path when
+ performing
+
+download on the commandline. From Swival scanner
+
+CVE: CVE-2026-59995
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b]
+
+Backport Changes:
+- Retained the Scarthgap sftp.c OpenBSD revision identifier because the
+ 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
+(cherry picked from commit 1b39f39657d2e58f8ec57341581a39bbf0be645b)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sftp.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sftp.c b/sftp.c
+index c609b4153..487e53976 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2268,13 +2268,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ return (-1);
+ }
+ } else {
+- /* XXX this is wrong wrt quoting */
+- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+- global_aflag ? " -a" : "", dir,
+- file2 == NULL ? "" : " ",
+- file2 == NULL ? "" : file2);
+- err = parse_dispatch_command(conn, cmd,
+- &remote_path, startdir, 1, 0);
++ err = process_get(conn, dir, file2, remote_path, 0, 0,
++ global_aflag, 0);
+ free(dir);
+ free(startdir);
+ free(remote_path);
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index c2e172c8d6..b4885ab151 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -41,6 +41,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59997.patch \
file://CVE-2026-59998.patch \
file://CVE-2026-59996.patch \
+ file://CVE-2026-59995.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59998. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59998.patch | 34 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
new file mode 100644
index 0000000000..a9a13aa70e
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
@@ -0,0 +1,34 @@
+From f1fd8585548735bcba25faa13073aafb5f8686ca Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 24 Jun 2026 06:55:12 +0000
+Subject: [PATCH] upstream: mention a caveat regarding
+ GSSAPIStrictAcceptorCheck in
+
+some environments
+
+CVE: CVE-2026-59998
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432]
+
+Backport Changes:
+- Retained the Scarthgap sshd_config.5 OpenBSD revision identifier and
+ Mdocdate because the 10.4 values do not describe the older manual page.
+
+OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2
+(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sshd_config.5 | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sshd_config.5 b/sshd_config.5
+index 7e1a56cd0..e1c8dcaa2 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -745,6 +745,7 @@ machine's default store.
+ This facility is provided to assist with operation on multi homed machines.
+ The default is
+ .Cm yes .
++This option may not be effective in Windows Active Directory environments.
+ .It Cm HostbasedAcceptedAlgorithms
+ Specifies the signature algorithms that will be accepted for hostbased
+ authentication as a list of comma-separated patterns.
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 3c706b00ae..256d90e7bd 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -39,6 +39,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35388.patch \
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
+ file://CVE-2026-59998.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59999. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59999
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59999.patch | 36 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
new file mode 100644
index 0000000000..89b7aa9c7f
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
@@ -0,0 +1,36 @@
+From 1c719fa7d0fb0aa335f0e8d5db5d5e5d01c894e5 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 31 May 2026 04:47:29 +0000
+Subject: [PATCH] upstream: DisableForwarding=yes didn't override
+ PermitTunnel=yes
+
+Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
+Jevtic; ok markus@
+
+CVE: CVE-2026-59999
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753]
+
+Backport Changes:
+- Retained the Scarthgap serverloop.c OpenBSD revision identifier because
+ the 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
+(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ serverloop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/serverloop.c b/serverloop.c
+index f3683c2e4..c1fe99d12 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -531,7 +531,7 @@ server_request_tun(struct ssh *ssh)
+ ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ return NULL;
+ }
+- if ((options.permit_tun & mode) == 0) {
++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) {
+ ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ "forwarding");
+ return NULL;
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 4193bc8a5b..efb89d45d7 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -37,6 +37,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35385.patch \
file://CVE-2026-35414-CVE-2026-35387.patch \
file://CVE-2026-35388.patch \
+ file://CVE-2026-59999.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59996. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59996
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59996.patch | 37 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 38 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
new file mode 100644
index 0000000000..b13390b25b
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
@@ -0,0 +1,37 @@
+From 762b3d438547893d62ce3e147dce6cef14697b09 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 28 Jun 2026 23:47:16 +0000
+Subject: [PATCH] upstream: resist that return ".." via remote glob during
+
+remote/remote copies, similar to fixes for bz3871 for remote/local copies.
+From Swival scanner
+
+CVE: CVE-2026-59996
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78]
+
+Backport Changes:
+- Retained the Scarthgap scp.c OpenBSD revision identifier because the
+ 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5
+(cherry picked from commit 36480181fa22f98e180b4f9e10203480c0346c78)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ scp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scp.c b/scp.c
+index 2c21fa19a..00d87517d 100644
+--- a/scp.c
++++ b/scp.c
+@@ -2043,6 +2043,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to,
+ goto out;
+ }
+
++ /* Special handling for source of '..' */
++ if (strcmp(filename, "..") == 0)
++ filename = "."; /* Download to dest, not dest/.. */
++
+ if (targetisdir)
+ abs_dst = sftp_path_append(target, filename);
+ else
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 256d90e7bd..c2e172c8d6 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -40,6 +40,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
file://CVE-2026-59998.patch \
+ file://CVE-2026-59996.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60000. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60000
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60000.patch | 140 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 141 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
new file mode 100644
index 0000000000..9c25786ced
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
@@ -0,0 +1,140 @@
+From 055316632809a2e2e58eac2020699b52187d1b11 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:53:30 +0000
+Subject: [PATCH] upstream: Fix multiple RFC 4462 (GSSAPIAuthentication)
+ compliance
+
+problems
+
+1) Remove an early failure return for GSSAPI authentication attempts
+made for invalid accounts that yielded different behaviour for
+valid vs invalid accounts.
+
+2) Fix a situation where some GSSAPI requestes were not correctly
+subjected to MaxAuthTries.
+
+3) Fix a moderate pre-authentication resource DoS related to #2.
+
+Add missing logging for error cases.
+
+Report and fixes from Manfred Kaiser, milCERT AT
+
+CVE: CVE-2026-60000
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192]
+
+Backport Changes:
+- Kept Scarthgap's PRIVSEP(ssh_gssapi_server_ctx()) interface and its
+ authentication-context guard while applying the upstream RFC 4462 state,
+ failure, logging, and MaxAuthTries changes.
+- Retained the Scarthgap auth2-gss.c OpenBSD revision identifier.
+
+OpenBSD-Commit-ID: ca0acdd64eea435d6f89534538a9eb404a5629d3
+(cherry picked from commit 5d04ca6af739b82fd30d84d2783ca802ebfa1192)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth2-gss.c | 53 ++++++++++++++++++++++++-----------------------------
+ 1 file changed, 24 insertions(+), 29 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 195578bcf..6846eae5b 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -110,12 +110,6 @@ userauth_gssapi(struct ssh *ssh, const char *method)
+ return (0);
+ }
+
+- if (!authctxt->valid || authctxt->user == NULL) {
+- debug2_f("disabled because of invalid user");
+- free(doid);
+- return (0);
+- }
+-
+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
+ if (ctxt != NULL)
+ ssh_gssapi_delete_ctx(&ctxt);
+@@ -177,8 +171,14 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
+ (r = sshpkt_send(ssh)) != 0)
+ fatal_fr(r, "send ERRTOK packet");
+ }
++ logit("Failed gssapi-with-mic for %s%.100s "
++ "from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ } else {
+ if (send_tok.length != 0) {
+@@ -190,14 +190,18 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
+ fatal_fr(r, "send TOKEN packet");
+ }
+ if (maj_status == GSS_S_COMPLETE) {
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+- if (flags & GSS_C_INTEG_FLAG)
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ /* note: keep ERRTOK handler as per RFC 4462 s3.4 */
++ if (flags & GSS_C_INTEG_FLAG) {
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_MIC,
+ &input_gssapi_mic);
+- else
++ } else {
+ ssh_dispatch_set(ssh,
+ SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
+ &input_gssapi_exchange_complete);
++ }
+ }
+ }
+
+@@ -209,10 +213,6 @@ static int
+ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
+ {
+ Authctxt *authctxt = ssh->authctxt;
+- Gssctxt *gssctxt;
+- gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+- gss_buffer_desc recv_tok;
+- OM_uint32 maj_status;
+ int r;
+ u_char *p;
+ size_t len;
+@@ -220,26 +220,21 @@ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
+ if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
+ fatal("No authentication or GSSAPI context");
+
+- gssctxt = authctxt->methoddata;
+- if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
++ /* Minimal error handling - just cancel auth and return FAILURE */
++ if ((r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ fatal_fr(r, "parse packet");
+- recv_tok.value = p;
+- recv_tok.length = len;
+-
+- /* Push the error token into GSSAPI to see what it says */
+- maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
+- &send_tok, NULL));
+-
+- free(recv_tok.value);
+
+- /* We can't return anything to the client, even if we wanted to */
++ logit("Failed gssapi-with-mic for %s%.100s from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
++ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+-
+- /* The client will have already moved on to the next auth */
+-
+- gss_release_buffer(&maj_status, &send_tok);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
++ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ return 0;
+ }
+
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index a6bf37d8a6..95c546489f 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -44,6 +44,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
file://CVE-2026-60002.patch \
+ file://CVE-2026-60000.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59997. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59997
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59997.patch | 58 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 59 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
new file mode 100644
index 0000000000..aa171def01
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
@@ -0,0 +1,58 @@
+From 3011cbb6bb73f3f3dc90fa1d48736803fa407509 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 5 Jun 2026 08:53:07 +0000
+Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp
+ server,
+
+previously they were silently dropped; reported by Steve Caffrey ok deraadt@
+
+CVE: CVE-2026-59997
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014]
+
+Backport Changes:
+- Retained the Scarthgap session.c OpenBSD revision identifier because the
+ 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624
+(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ session.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/session.c b/session.c
+index eb932b8bf..1a01ecf74 100644
+--- a/session.c
++++ b/session.c
+@@ -1650,21 +1650,22 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+ exit(1);
+ } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) {
+ extern int optind, optreset;
+- int i;
+- char *p, *args;
++ int sftp_argc;
++ char **sftp_argv;
+
+ setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME);
+- args = xstrdup(command ? command : "sftp-server");
+- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " ")))
+- if (i < ARGV_MAX - 1)
+- argv[i++] = p;
+- argv[i] = NULL;
++ if (argv_split(command == NULL ? "sftp-server" : command,
++ &sftp_argc, &sftp_argv, 1) != 0) {
++ error("internal error: can't split internal-sftp "
++ "arguments");
++ exit(1);
++ }
+ optind = optreset = 1;
+- __progname = argv[0];
++ __progname = sftp_argv[0];
+ #ifdef WITH_SELINUX
+ ssh_selinux_change_context("sftpd_t");
+ #endif
+- exit(sftp_server_main(i, argv, s->pw));
++ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw));
+ }
+
+ fflush(NULL);
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index efb89d45d7..3c706b00ae 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -38,6 +38,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35414-CVE-2026-35387.patch \
file://CVE-2026-35388.patch \
file://CVE-2026-59999.patch \
+ file://CVE-2026-59997.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This series backports security fixes from OpenSSH 10.4 to the OpenSSH
9.6p1 recipe in Scarthgap. The relevant upstream fixes are carried as
individual patches instead of upgrading the stable-branch recipe.
- CVE-2026-59995: Command-line SCP downloads could use a path controlled
by the server. Fixed by retaining the client-selected destination path
rather than allowing the server response to redirect the download.
Upstream: https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
- CVE-2026-59996: A remote glob could return ".." during remote-to-remote
copies and escape the expected path handling. Fixed by rejecting the
parent-directory result, matching the existing remote-to-local
protection.
Upstream: https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
- CVE-2026-59997: The internal-sftp server silently dropped command-line
arguments after the ninth argument. Fixed by passing the complete
argument vector to internal-sftp.
Upstream: https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
- CVE-2026-59998: Some environments require special consideration when
using GSSAPIStrictAcceptorCheck. Fixed by documenting the configuration
caveat in the upstream manual page.
Upstream: https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432
- CVE-2026-59999: DisableForwarding=yes did not override
PermitTunnel=yes. Fixed by including tunnel permission in the
DisableForwarding policy enforcement.
Upstream: https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
- CVE-2026-60000: Multiple RFC 4462 GSSAPI authentication issues caused
different behavior for valid and invalid accounts, incomplete
MaxAuthTries enforcement, and a moderate pre-authentication resource
denial of service. Fixed by aligning failure handling, applying attempt
limits consistently, and adding missing error logging.
Upstream: https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
- CVE-2026-60001: GSSAPI and keyboard-interactive authentication paths
did not always enforce the minimum per-attempt delay. Fixed by applying
the delay consistently to the affected authentication failures.
Upstream: https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
- CVE-2026-60002: Several pieces of client state had incorrect ownership
or lifetime, including a cached host key that could be freed too early
and subsequently used. Fixed by retaining connection-scoped state for
the full lifetime of the connection.
Upstream: https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
Each fix is kept in a separate commit for independent review and CVE
tracking. The OpenSSH recipe applies the patches in series order.
Validation:
- Built openssh successfully after applying the full series.
- Built core-image-minimal successfully with ptest packages enabled.
Devansh Patel (8):
openssh: Fix CVE-2026-59999
openssh: Fix CVE-2026-59997
openssh: Fix CVE-2026-59998
openssh: Fix CVE-2026-59996
openssh: Fix CVE-2026-59995
openssh: Fix CVE-2026-60001
openssh: Fix CVE-2026-60002
openssh: Fix CVE-2026-60000
.../openssh/openssh/CVE-2026-59995.patch | 42 ++++
.../openssh/openssh/CVE-2026-59996.patch | 37 +++
.../openssh/openssh/CVE-2026-59997.patch | 58 +++++
.../openssh/openssh/CVE-2026-59998.patch | 34 +++
.../openssh/openssh/CVE-2026-59999.patch | 36 +++
.../openssh/openssh/CVE-2026-60000.patch | 140 +++++++++++
.../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++
.../openssh/openssh/CVE-2026-60002.patch | 226 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 8 +
9 files changed, 711 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
--
2.44.4
^ permalink raw reply
* [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60001. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60001
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 131 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
new file mode 100644
index 0000000000..ff1d14c7c9
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
@@ -0,0 +1,130 @@
+From ef41798b35a53757f8aa08ad14ee1463b0fe9b15 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:44:48 +0000
+Subject: [PATCH] upstream: Fix cases in GSSAPI and keyboard-interactive
+
+authentication where the minimum per-attempt delay was not being enforced.
+
+Reported by Orange Cyberdefense Vulnerability Team
+
+CVE: CVE-2026-60001
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454]
+
+Backport Changes:
+- Kept Scarthgap's PRIVSEP(ssh_gssapi_userok()) interface and GSSAPI
+ display-name recording while adding the upstream failure-delay calls;
+ mm_ssh_gssapi_userok() belongs to the later split-sshd architecture.
+- Retained the Scarthgap OpenBSD revision identifiers in auth.h,
+ auth2-chall.c, auth2-gss.c, and auth2.c.
+
+OpenBSD-Commit-ID: c40bd35cc2428fcaccad7a141703c28baa6da01e
+(cherry picked from commit d43ba60c91cb323ca921049b7d43b1908c318454)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth.h | 1 +
+ auth2-chall.c | 4 ++++
+ auth2-gss.c | 7 +++++++
+ auth2.c | 10 ++++++++--
+ 4 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/auth.h b/auth.h
+index 6d2d39762..9ad4898c5 100644
+--- a/auth.h
++++ b/auth.h
+@@ -173,6 +173,7 @@ void auth_log(struct ssh *, int, int, const char *, const char *);
+ void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn));
+ void userauth_finish(struct ssh *, int, const char *, const char *);
+ int auth_root_allowed(struct ssh *, const char *);
++void auth_failure_delay(Authctxt *, double);
+
+ char *auth2_read_banner(void);
+ int auth2_methods_valid(const char *, int);
+diff --git a/auth2-chall.c b/auth2-chall.c
+index 021df8291..20e70d222 100644
+--- a/auth2-chall.c
++++ b/auth2-chall.c
+@@ -296,6 +296,7 @@ input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh)
+ u_int i, nresp;
+ const char *devicename = NULL;
+ char **response = NULL;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal_f("no authctxt");
+@@ -354,6 +355,9 @@ input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh)
+ auth2_challenge_start(ssh);
+ }
+ }
++
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+ userauth_finish(ssh, authenticated, "keyboard-interactive",
+ devicename);
+ return 0;
+diff --git a/auth2-gss.c b/auth2-gss.c
+index f72a38998..195578bcf 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -255,6 +255,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+ Authctxt *authctxt = ssh->authctxt;
+ int r, authenticated;
+ const char *displayname;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
+ fatal("No authentication or GSSAPI context");
+@@ -268,6 +269,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+ fatal_fr(r, "parse packet");
+
+ authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+
+ if ((!use_privsep || mm_is_monitor()) &&
+ (displayname = ssh_gssapi_displayname()) != NULL)
+@@ -293,6 +296,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+ const char *displayname;
+ u_char *p;
+ size_t len;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
+ fatal("No authentication or GSSAPI context");
+@@ -320,6 +324,9 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+ sshbuf_free(b);
+ free(mic.value);
+
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
++
+ if ((!use_privsep || mm_is_monitor()) &&
+ (displayname = ssh_gssapi_displayname()) != NULL)
+ auth2_record_info(authctxt, "%s", displayname);
+diff --git a/auth2.c b/auth2.c
+index 271789a77..18077d625 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -265,6 +265,12 @@ ensure_minimum_time_since(double start, double seconds)
+ nanosleep(&ts, NULL);
+ }
+
++void
++auth_failure_delay(Authctxt *authctxt, double tstart)
++{
++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user));
++}
++
+ static int
+ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ {
+@@ -348,8 +354,8 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ authenticated = m->userauth(ssh, method);
+ }
+ if (!authctxt->authenticated && strcmp(method, "none") != 0)
+- ensure_minimum_time_since(tstart,
+- user_specific_delay(authctxt->user));
++ auth_failure_delay(authctxt, tstart);
++
+ userauth_finish(ssh, authenticated, method, NULL);
+ r = 0;
+ out:
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index b4885ab151..b15b909f60 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -42,6 +42,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59998.patch \
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
+ file://CVE-2026-60001.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720185749.4098075-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60002. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60002
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60002.patch | 226 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 227 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
new file mode 100644
index 0000000000..9e94e77261
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
@@ -0,0 +1,226 @@
+From 767104acedd68c317b9d8fb603561e1a8be9e76a Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:49:58 +0000
+Subject: [PATCH] upstream: fix ownership and lifetime of several bits of
+ client
+
+state that need to persist for the life of the connection, especially the
+cached hostkey that was being incorrectly freed early on some paths, possibly
+allowing its use after free.
+
+Reported by Zhenpeng (Leo) Lin from depthfirst.com
+
+CVE: CVE-2026-60002
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23]
+
+Backport Changes:
+- Retained Scarthgap's valid_hostname() and valid_ruser() helpers when
+ relocating ssh_conn_info_free() from ssh.c to sshconnect.c.
+- Retained Scarthgap's ext-info-c proposal handling while applying the
+ upstream connection-state ownership and lifetime changes.
+- Retained the Scarthgap OpenBSD revision identifiers in ssh.c,
+ sshconnect.c, sshconnect.h, and sshconnect2.c.
+
+OpenBSD-Commit-ID: faaa6ad72e7d69d41fa8b197b606265b7d9bc73f
+(cherry picked from commit e8bdfb151a356d0171fea4194dd205fbb252be23)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ ssh.c | 24 ++----------------------
+ sshconnect.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
+ sshconnect.h | 7 +++++--
+ sshconnect2.c | 20 +++++++++++---------
+ 4 files changed, 63 insertions(+), 35 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index 9c49f98a8..aecdb79ea 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -606,26 +606,6 @@ set_addrinfo_port(struct addrinfo *addrs, int port)
+ }
+ }
+
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+- if (cinfo == NULL)
+- return;
+- free(cinfo->conn_hash_hex);
+- free(cinfo->shorthost);
+- free(cinfo->uidstr);
+- free(cinfo->keyalias);
+- free(cinfo->thishost);
+- free(cinfo->host_arg);
+- free(cinfo->portstr);
+- free(cinfo->remhost);
+- free(cinfo->remuser);
+- free(cinfo->homedir);
+- free(cinfo->locuser);
+- free(cinfo->jmphost);
+- free(cinfo);
+-}
+-
+ static int
+ valid_hostname(const char *s)
+ {
+@@ -1771,8 +1751,8 @@ main(int ac, char **av)
+ ssh_signal(SIGCHLD, main_sigchld_handler);
+
+ /* Log into the remote system. Never returns if the login fails. */
+- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+- options.port, pw, timeout_ms, cinfo);
++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++ pw, timeout_ms, cinfo);
+
+ /* We no longer need the private host keys. Clear them now. */
+ if (sensitive_data.nkeys != 0) {
+diff --git a/sshconnect.c b/sshconnect.c
+index bd077c75c..7823b6782 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -83,6 +83,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++ if (cinfo == NULL)
++ return;
++ free(cinfo->conn_hash_hex);
++ free(cinfo->shorthost);
++ free(cinfo->uidstr);
++ free(cinfo->keyalias);
++ free(cinfo->thishost);
++ free(cinfo->host_arg);
++ free(cinfo->portstr);
++ free(cinfo->remhost);
++ free(cinfo->remuser);
++ free(cinfo->homedir);
++ free(cinfo->locuser);
++ free(cinfo->jmphost);
++ freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++ struct ssh_conn_info *ret;
++
++ if (cinfo == NULL)
++ return NULL;
++ ret = xcalloc(1, sizeof(*ret));
++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++ ret->shorthost = xstrdup(cinfo->shorthost);
++ ret->uidstr = xstrdup(cinfo->uidstr);
++ ret->keyalias = xstrdup(cinfo->keyalias);
++ ret->thishost = xstrdup(cinfo->thishost);
++ ret->host_arg = xstrdup(cinfo->host_arg);
++ ret->portstr = xstrdup(cinfo->portstr);
++ ret->remhost = xstrdup(cinfo->remhost);
++ ret->remuser = xstrdup(cinfo->remuser);
++ ret->homedir = xstrdup(cinfo->homedir);
++ ret->locuser = xstrdup(cinfo->locuser);
++ ret->jmphost = xstrdup(cinfo->jmphost);
++ return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1559,8 +1602,8 @@ out:
+ */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+- const struct ssh_conn_info *cinfo)
++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++ int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ char *host;
+ char *server_user, *local_user;
+diff --git a/sshconnect.h b/sshconnect.h
+index 79d35cc19..da2a73f5a 100644
+--- a/sshconnect.h
++++ b/sshconnect.h
+@@ -71,7 +71,7 @@ int ssh_connect(struct ssh *, const char *, const char *,
+ void ssh_kill_proxy_command(void);
+
+ void ssh_login(struct ssh *, Sensitive *, const char *,
+- struct sockaddr *, u_short, struct passwd *, int,
++ struct sockaddr_storage *, u_short, struct passwd *, int,
+ const struct ssh_conn_info *);
+
+ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -80,7 +80,7 @@ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+ void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+ char **, char **);
+
+-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+ const struct ssh_conn_info *);
+
+ void ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -94,3 +94,6 @@ void maybe_add_key_to_agent(const char *, struct sshkey *,
+ void load_hostkeys_command(struct hostkeys *, const char *,
+ const char *, const struct ssh_conn_info *,
+ const struct sshkey *, const char *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);
+diff --git a/sshconnect2.c b/sshconnect2.c
+index a296c9b8c..9efb3da8a 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -89,7 +89,7 @@ extern Options options;
+ */
+
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+
+@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ fatal("Server host key %s not in HostKeyAlgorithms",
+ sshkey_ssh_name(hostkey));
+ }
+- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ xxx_conn_info) != 0)
+ fatal("Host key verification failed.");
+ return 0;
+@@ -222,16 +222,16 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
+ }
+
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+- const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++ u_short port, const struct ssh_conn_info *cinfo)
+ {
+ char *myproposal[PROPOSAL_MAX];
+ char *s, *all_key, *hkalgs = NULL;
+ int r, use_known_hosts_order = 0;
+
+- xxx_host = host;
+- xxx_hostaddr = hostaddr;
+- xxx_conn_info = cinfo;
++ xxx_host = xstrdup(host);
++ xxx_hostaddr = *hostaddr;
++ xxx_conn_info = ssh_conn_info_dup(cinfo);
+
+ if (options.rekey_limit || options.rekey_interval)
+ ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -257,8 +257,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+ if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
+ fatal_f("kex_names_cat");
+
+- if (use_known_hosts_order)
+- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++ if (use_known_hosts_order) {
++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++ port, cinfo);
++ }
+
+ kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers,
+ options.macs, compression_alg_list(options.compression),
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index b15b909f60..a6bf37d8a6 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -43,6 +43,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
+ file://CVE-2026-60002.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related
* [OE-core][scarthgap][PATCH] libxml2: Fix CVE-2026-11979
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:42 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-11979
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../libxml/libxml2/CVE-2026-11979.patch | 70 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 +
2 files changed, 71 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
new file mode 100644
index 0000000000..427026b345
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
@@ -0,0 +1,70 @@
+From d8566dd918c612078dfb3ee1a95d7bb6f0656bfe Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Fri, 22 May 2026 12:21:20 +0200
+Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
+
+CVE: CVE-2026-11979
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e]
+
+Backport Changes:
+- The commit modifies test/catalogs/test.sh.
+- test/catalogs/test.sh does not exist in the libxml2 v2.12.10
+ source used in Scarthgap and was introduced later version
+ libxml2 v2.14.0 [1].
+- The test changes were omitted; only the required fix in
+ xmlcatalog.c was backported.
+
+[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/f06fc933cdaea2ce8e9cea275fdbf4edb85f9837
+
+(cherry picked from commit c2e233fc1b341685fc99621b2768b503f777a72e)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ xmlcatalog.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/xmlcatalog.c b/xmlcatalog.c
+index 588802b41..51569b879 100644
+--- a/xmlcatalog.c
++++ b/xmlcatalog.c
+@@ -114,6 +114,12 @@ static void usershell(void) {
+ (*cur != '\n') && (*cur != '\r')) {
+ if (*cur == 0)
+ break;
++ /* Do not read beyond the command array capacity */
++ if (i >= (int)sizeof(command) - 2) {
++ printf("Invalid command %s\n", cur);
++ i = 0;
++ break;
++ }
+ command[i++] = *cur++;
+ }
+ command[i] = 0;
+@@ -131,6 +137,11 @@ static void usershell(void) {
+ while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
+ if (*cur == 0)
+ break;
++ if (i >= (int)sizeof(arg) - 2) {
++ printf("Invalid arg %s\n", arg);
++ i = 0;
++ break;
++ }
+ arg[i++] = *cur++;
+ }
+ arg[i] = 0;
+@@ -143,6 +154,11 @@ static void usershell(void) {
+ cur = arg;
+ memset(argv, 0, sizeof(argv));
+ while (*cur != 0) {
++ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
++ printf("Too much arguments\n");
++ break;
++ }
++
+ while ((*cur == ' ') || (*cur == '\t')) cur++;
+ if (*cur == '\'') {
+ cur++;
+--
+2.35.6
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 2bfa78324f..d476ba14b6 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -31,6 +31,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2026-0992-02.patch \
file://CVE-2026-0992-03.patch \
file://CVE-2026-1757.patch \
+ file://CVE-2026-11979.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
--
2.44.4
^ permalink raw reply related
* [OE-core][wrynose][PATCH 1/8] openssh: Fix CVE-2026-59999
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59999. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
[2] https://www.cve.org/CVERecord?id=CVE-2026-59999
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59999.patch | 38 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
new file mode 100644
index 0000000000..5907a991b9
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
@@ -0,0 +1,38 @@
+From a83dd105dc407d95c42140ea6f04a1e247aaf2f9 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 31 May 2026 04:47:29 +0000
+Subject: [PATCH] upstream: DisableForwarding=yes didn't override
+ PermitTunnel=yes
+
+Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
+Jevtic; ok markus@
+
+OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
+
+CVE: CVE-2026-59999
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in serverloop.c and
+ retained the Wrynose OpenSSH 10.3p1 revision because this stable
+ backport carries only the functional security change.
+
+(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ serverloop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/serverloop.c b/serverloop.c
+index 8e63480ec..42c3ce9fe 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -523,7 +523,7 @@ server_request_tun(struct ssh *ssh)
+ ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ return NULL;
+ }
+- if ((options.permit_tun & mode) == 0) {
++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) {
+ ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ "forwarding");
+ return NULL;
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index a050475532..2c3b839442 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -24,6 +24,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://run-ptest \
file://sshd_check_keys \
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
+ file://CVE-2026-59999.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 6/8] openssh: Fix CVE-2026-60001
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-60001. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
[2] https://www.cve.org/CVERecord?id=CVE-2026-60001
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 131 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
new file mode 100644
index 0000000000..aa32484b17
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
@@ -0,0 +1,130 @@
+From 6bc7dd87d543c882994f95c8309846dfda9ab503 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:44:48 +0000
+Subject: [PATCH] upstream: Fix cases in GSSAPI and keyboard-interactive
+
+authentication where the minimum per-attempt delay was not being enforced.
+
+Reported by Orange Cyberdefense Vulnerability Team
+
+OpenBSD-Commit-ID: c40bd35cc2428fcaccad7a141703c28baa6da01e
+
+CVE: CVE-2026-60001
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunks in auth.h,
+ auth2-chall.c, auth2-gss.c, and auth2.c and retained the Wrynose
+ OpenSSH 10.3p1 revisions because this stable backport carries only the
+ functional security changes.
+
+(cherry picked from commit d43ba60c91cb323ca921049b7d43b1908c318454)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth.h | 1 +
+ auth2-chall.c | 4 ++++
+ auth2-gss.c | 7 +++++++
+ auth2.c | 10 ++++++++--
+ 4 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/auth.h b/auth.h
+index 634a84aa8..c2cfa5ed8 100644
+--- a/auth.h
++++ b/auth.h
+@@ -175,6 +175,7 @@ void auth_log(struct ssh *, int, int, const char *, const char *);
+ void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn));
+ void userauth_finish(struct ssh *, int, const char *, const char *);
+ int auth_root_allowed(struct ssh *, const char *);
++void auth_failure_delay(Authctxt *, double);
+
+ char *auth2_read_banner(void);
+ int auth2_methods_valid(const char *, int);
+diff --git a/auth2-chall.c b/auth2-chall.c
+index f3889079b..4687ca8e2 100644
+--- a/auth2-chall.c
++++ b/auth2-chall.c
+@@ -300,6 +300,7 @@ input_userauth_info_response(int type, uint32_t seq, struct ssh *ssh)
+ u_int i, nresp;
+ const char *devicename = NULL;
+ char **response = NULL;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal_f("no authctxt");
+@@ -358,6 +359,9 @@ input_userauth_info_response(int type, uint32_t seq, struct ssh *ssh)
+ auth2_challenge_start(ssh);
+ }
+ }
++
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+ userauth_finish(ssh, authenticated, "keyboard-interactive",
+ devicename);
+ return 0;
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 053548527..f27ac9221 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -255,6 +255,7 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh)
+ {
+ Authctxt *authctxt = ssh->authctxt;
+ int r, authenticated;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+@@ -268,6 +269,8 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh)
+ fatal_fr(r, "parse packet");
+
+ authenticated = mm_ssh_gssapi_userok(authctxt->user);
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+@@ -288,6 +291,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+ gss_buffer_desc mic, gssbuf;
+ u_char *p;
+ size_t len;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+@@ -315,6 +319,9 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+ sshbuf_free(b);
+ free(mic.value);
+
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
++
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+diff --git a/auth2.c b/auth2.c
+index 3a1682746..7ba611c02 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -265,6 +265,12 @@ ensure_minimum_time_since(double start, double seconds)
+ nanosleep(&ts, NULL);
+ }
+
++void
++auth_failure_delay(Authctxt *authctxt, double tstart)
++{
++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user));
++}
++
+ static int
+ input_userauth_request(int type, uint32_t seq, struct ssh *ssh)
+ {
+@@ -346,8 +352,8 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh)
+ authenticated = m->userauth(ssh, method);
+ }
+ if (!authctxt->authenticated && strcmp(method, "none") != 0)
+- ensure_minimum_time_since(tstart,
+- user_specific_delay(authctxt->user));
++ auth_failure_delay(authctxt, tstart);
++
+ userauth_finish(ssh, authenticated, method, NULL);
+ r = 0;
+ out:
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 4aa81214e0..dba0dcaa8a 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -29,6 +29,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59998.patch \
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
+ file://CVE-2026-60001.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 2/8] openssh: Fix CVE-2026-59997
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59997. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
[2] https://www.cve.org/CVERecord?id=CVE-2026-59997
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59997.patch | 60 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 61 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
new file mode 100644
index 0000000000..7d77fbcc9e
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
@@ -0,0 +1,60 @@
+From 91ce99061c78d0ae84dafc96409c8ea9746f70c0 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 5 Jun 2026 08:53:07 +0000
+Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp
+ server,
+
+previously they were silently dropped; reported by Steve Caffrey ok deraadt@
+
+OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624
+
+CVE: CVE-2026-59997
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in session.c and
+ retained the Wrynose OpenSSH 10.3p1 revision because this stable
+ backport carries only the functional security change.
+
+(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ session.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/session.c b/session.c
+index 93de35d7c..b1f125a3c 100644
+--- a/session.c
++++ b/session.c
+@@ -1607,21 +1607,22 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+ exit(1);
+ } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) {
+ extern int optind, optreset;
+- int i;
+- char *p, *args;
++ int sftp_argc;
++ char **sftp_argv;
+
+ setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME);
+- args = xstrdup(command ? command : "sftp-server");
+- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " ")))
+- if (i < ARGV_MAX - 1)
+- argv[i++] = p;
+- argv[i] = NULL;
++ if (argv_split(command == NULL ? "sftp-server" : command,
++ &sftp_argc, &sftp_argv, 1) != 0) {
++ error("internal error: can't split internal-sftp "
++ "arguments");
++ exit(1);
++ }
+ optind = optreset = 1;
+- __progname = argv[0];
++ __progname = sftp_argv[0];
+ #ifdef WITH_SELINUX
+ ssh_selinux_change_context("sftpd_t");
+ #endif
+- exit(sftp_server_main(i, argv, s->pw));
++ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw));
+ }
+
+ fflush(NULL);
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 2c3b839442..87bd417b2d 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -25,6 +25,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://sshd_check_keys \
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
file://CVE-2026-59999.patch \
+ file://CVE-2026-59997.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 8/8] openssh: Fix CVE-2026-60000
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-60000. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
[2] https://www.cve.org/CVERecord?id=CVE-2026-60000
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60000.patch | 140 ++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 141 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
new file mode 100644
index 0000000000..e9b62e6454
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
@@ -0,0 +1,140 @@
+From 884e94fafb20259c78bf394611b9929a7683e2b3 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:53:30 +0000
+Subject: [PATCH] upstream: Fix multiple RFC 4462 (GSSAPIAuthentication)
+ compliance
+
+problems
+
+1) Remove an early failure return for GSSAPI authentication attempts
+made for invalid accounts that yielded different behaviour for
+valid vs invalid accounts.
+
+2) Fix a situation where some GSSAPI requestes were not correctly
+subjected to MaxAuthTries.
+
+3) Fix a moderate pre-authentication resource DoS related to #2.
+
+Add missing logging for error cases.
+
+Report and fixes from Manfred Kaiser, milCERT AT
+
+OpenBSD-Commit-ID: ca0acdd64eea435d6f89534538a9eb404a5629d3
+
+CVE: CVE-2026-60000
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in auth2-gss.c and
+ retained the Wrynose OpenSSH 10.3p1 revision because this stable
+ backport carries only the functional security change.
+
+(cherry picked from commit 5d04ca6af739b82fd30d84d2783ca802ebfa1192)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth2-gss.c | 53 ++++++++++++++++++++++++-----------------------------
+ 1 file changed, 24 insertions(+), 29 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index f27ac9221..54c96fe4b 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -111,12 +111,6 @@ userauth_gssapi(struct ssh *ssh, const char *method)
+ return (0);
+ }
+
+- if (!authctxt->valid || authctxt->user == NULL) {
+- debug2_f("disabled because of invalid user");
+- free(doid);
+- return (0);
+- }
+-
+ if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, &goid))) {
+ if (ctxt != NULL)
+ ssh_gssapi_delete_ctx(&ctxt);
+@@ -178,8 +172,14 @@ input_gssapi_token(int type, uint32_t plen, struct ssh *ssh)
+ (r = sshpkt_send(ssh)) != 0)
+ fatal_fr(r, "send ERRTOK packet");
+ }
++ logit("Failed gssapi-with-mic for %s%.100s "
++ "from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ } else {
+ if (send_tok.length != 0) {
+@@ -191,14 +191,18 @@ input_gssapi_token(int type, uint32_t plen, struct ssh *ssh)
+ fatal_fr(r, "send TOKEN packet");
+ }
+ if (maj_status == GSS_S_COMPLETE) {
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+- if (flags & GSS_C_INTEG_FLAG)
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ /* note: keep ERRTOK handler as per RFC 4462 s3.4 */
++ if (flags & GSS_C_INTEG_FLAG) {
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_MIC,
+ &input_gssapi_mic);
+- else
++ } else {
+ ssh_dispatch_set(ssh,
+ SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
+ &input_gssapi_exchange_complete);
++ }
+ }
+ }
+
+@@ -210,10 +214,6 @@ static int
+ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ {
+ Authctxt *authctxt = ssh->authctxt;
+- Gssctxt *gssctxt;
+- gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+- gss_buffer_desc recv_tok;
+- OM_uint32 maj_status;
+ int r;
+ u_char *p;
+ size_t len;
+@@ -221,26 +221,21 @@ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+
+- gssctxt = authctxt->methoddata;
+- if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
++ /* Minimal error handling - just cancel auth and return FAILURE */
++ if ((r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ fatal_fr(r, "parse packet");
+- recv_tok.value = p;
+- recv_tok.length = len;
+-
+- /* Push the error token into GSSAPI to see what it says */
+- maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
+- &send_tok, NULL);
+-
+- free(recv_tok.value);
+
+- /* We can't return anything to the client, even if we wanted to */
++ logit("Failed gssapi-with-mic for %s%.100s from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
++ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+-
+- /* The client will have already moved on to the next auth */
+-
+- gss_release_buffer(&maj_status, &send_tok);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
++ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ return 0;
+ }
+
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index d3d00b994d..768ffcfbea 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -31,6 +31,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
file://CVE-2026-60002.patch \
+ file://CVE-2026-60000.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 4/8] openssh: Fix CVE-2026-59996
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59996. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
[2] https://www.cve.org/CVERecord?id=CVE-2026-59996
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59996.patch | 39 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
new file mode 100644
index 0000000000..9db9988690
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
@@ -0,0 +1,39 @@
+From f479595f7498e8c83d3df9d3eddb6e555497ff5b Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 28 Jun 2026 23:47:16 +0000
+Subject: [PATCH] upstream: resist that return ".." via remote glob during
+
+remote/remote copies, similar to fixes for bz3871 for remote/local copies.
+From Swival scanner
+
+OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5
+
+CVE: CVE-2026-59996
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in scp.c and retained
+ the Wrynose OpenSSH 10.3p1 revision because this stable backport carries
+ only the functional security change.
+
+(cherry picked from commit 36480181fa22f98e180b4f9e10203480c0346c78)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ scp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scp.c b/scp.c
+index 1faa9a555..bd01ebffd 100644
+--- a/scp.c
++++ b/scp.c
+@@ -2039,6 +2039,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to,
+ goto out;
+ }
+
++ /* Special handling for source of '..' */
++ if (strcmp(filename, "..") == 0)
++ filename = "."; /* Download to dest, not dest/.. */
++
+ if (targetisdir)
+ abs_dst = sftp_path_append(target, filename);
+ else
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index b9f2a37c57..807e718ffb 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -27,6 +27,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
file://CVE-2026-59998.patch \
+ file://CVE-2026-59996.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 5/8] openssh: Fix CVE-2026-59995
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59995. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
[2] https://www.cve.org/CVERecord?id=CVE-2026-59995
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59995.patch | 44 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
new file mode 100644
index 0000000000..ac1712eec2
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
@@ -0,0 +1,44 @@
+From 02e4b3cfd0bef64381921cdb9d6a21b1f50fdb74 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 29 Jun 2026 01:47:21 +0000
+Subject: [PATCH] upstream: avoid download to server-controlled path when
+ performing
+
+download on the commandline. From Swival scanner
+
+OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
+
+CVE: CVE-2026-59995
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in sftp.c and retained
+ the Wrynose OpenSSH 10.3p1 revision because this stable backport carries
+ only the functional security change.
+
+(cherry picked from commit 1b39f39657d2e58f8ec57341581a39bbf0be645b)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sftp.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sftp.c b/sftp.c
+index eebb166e8..33c8364e3 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2287,13 +2287,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ return (-1);
+ }
+ } else {
+- /* XXX this is wrong wrt quoting */
+- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+- global_aflag ? " -a" : "", dir,
+- file2 == NULL ? "" : " ",
+- file2 == NULL ? "" : file2);
+- err = parse_dispatch_command(conn, cmd,
+- &remote_path, startdir, 1, 0);
++ err = process_get(conn, dir, file2, remote_path, 0, 0,
++ global_aflag, 0);
+ free(dir);
+ free(startdir);
+ free(remote_path);
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 807e718ffb..4aa81214e0 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -28,6 +28,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59997.patch \
file://CVE-2026-59998.patch \
file://CVE-2026-59996.patch \
+ file://CVE-2026-59995.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 7/8] openssh: Fix CVE-2026-60002
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-60002. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
[2] https://www.cve.org/CVERecord?id=CVE-2026-60002
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60002.patch | 225 ++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 226 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
new file mode 100644
index 0000000000..85937279a2
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
@@ -0,0 +1,225 @@
+From b571549bc93e95f0d3d563094f825544228501de Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:49:58 +0000
+Subject: [PATCH] upstream: fix ownership and lifetime of several bits of
+ client
+
+state that need to persist for the life of the connection, especially the
+cached hostkey that was being incorrectly freed early on some paths, possibly
+allowing its use after free.
+
+Reported by Zhenpeng (Leo) Lin from depthfirst.com
+
+OpenBSD-Commit-ID: faaa6ad72e7d69d41fa8b197b606265b7d9bc73f
+
+CVE: CVE-2026-60002
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunks in ssh.c,
+ sshconnect.c, sshconnect.h, and sshconnect2.c and retained the Wrynose
+ OpenSSH 10.3p1 revisions because this stable backport carries only the
+ functional security changes.
+
+(cherry picked from commit e8bdfb151a356d0171fea4194dd205fbb252be23)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ ssh.c | 24 ++----------------------
+ sshconnect.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
+ sshconnect.h | 7 +++++--
+ sshconnect2.c | 20 +++++++++++---------
+ 4 files changed, 63 insertions(+), 35 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index 531f28eb2..efb8930f4 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -612,26 +612,6 @@ set_addrinfo_port(struct addrinfo *addrs, int port)
+ }
+ }
+
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+- if (cinfo == NULL)
+- return;
+- free(cinfo->conn_hash_hex);
+- free(cinfo->shorthost);
+- free(cinfo->uidstr);
+- free(cinfo->keyalias);
+- free(cinfo->thishost);
+- free(cinfo->host_arg);
+- free(cinfo->portstr);
+- free(cinfo->remhost);
+- free(cinfo->remuser);
+- free(cinfo->homedir);
+- free(cinfo->locuser);
+- free(cinfo->jmphost);
+- free(cinfo);
+-}
+-
+ /*
+ * Main program for the ssh client.
+ */
+@@ -1799,8 +1779,8 @@ main(int ac, char **av)
+ ssh_signal(SIGCHLD, main_sigchld_handler);
+
+ /* Log into the remote system. Never returns if the login fails. */
+- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+- options.port, pw, timeout_ms, cinfo);
++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++ pw, timeout_ms, cinfo);
+
+ /* We no longer need the private host keys. Clear them now. */
+ if (sensitive_data.nkeys != 0) {
+diff --git a/sshconnect.c b/sshconnect.c
+index 4384277a6..3d338ff23 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -70,6 +70,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++ if (cinfo == NULL)
++ return;
++ free(cinfo->conn_hash_hex);
++ free(cinfo->shorthost);
++ free(cinfo->uidstr);
++ free(cinfo->keyalias);
++ free(cinfo->thishost);
++ free(cinfo->host_arg);
++ free(cinfo->portstr);
++ free(cinfo->remhost);
++ free(cinfo->remuser);
++ free(cinfo->homedir);
++ free(cinfo->locuser);
++ free(cinfo->jmphost);
++ freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++ struct ssh_conn_info *ret;
++
++ if (cinfo == NULL)
++ return NULL;
++ ret = xcalloc(1, sizeof(*ret));
++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++ ret->shorthost = xstrdup(cinfo->shorthost);
++ ret->uidstr = xstrdup(cinfo->uidstr);
++ ret->keyalias = xstrdup(cinfo->keyalias);
++ ret->thishost = xstrdup(cinfo->thishost);
++ ret->host_arg = xstrdup(cinfo->host_arg);
++ ret->portstr = xstrdup(cinfo->portstr);
++ ret->remhost = xstrdup(cinfo->remhost);
++ ret->remuser = xstrdup(cinfo->remuser);
++ ret->homedir = xstrdup(cinfo->homedir);
++ ret->locuser = xstrdup(cinfo->locuser);
++ ret->jmphost = xstrdup(cinfo->jmphost);
++ return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1585,8 +1628,8 @@ warn_nonpq_kex(void)
+ */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+- const struct ssh_conn_info *cinfo)
++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++ int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ char *host;
+ char *server_user, *local_user;
+diff --git a/sshconnect.h b/sshconnect.h
+index 4c19490da..8da0e04b9 100644
+--- a/sshconnect.h
++++ b/sshconnect.h
+@@ -76,7 +76,7 @@ int ssh_connect(struct ssh *, const char *, const char *,
+ void ssh_kill_proxy_command(void);
+
+ void ssh_login(struct ssh *, Sensitive *, const char *,
+- struct sockaddr *, u_short, struct passwd *, int,
++ struct sockaddr_storage *, u_short, struct passwd *, int,
+ const struct ssh_conn_info *);
+
+ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -85,7 +85,7 @@ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+ void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+ char **, char **);
+
+-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+ const struct ssh_conn_info *);
+
+ void ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -101,3 +101,6 @@ void load_hostkeys_command(struct hostkeys *, const char *,
+ const struct sshkey *, const char *);
+
+ int hostkey_accepted_by_hostkeyalgs(const struct sshkey *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 478a9a52f..50ac6b89d 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -83,7 +83,7 @@ extern Options options;
+ */
+
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+
+@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ fatal("Server host key %s not in HostKeyAlgorithms",
+ sshkey_ssh_name(hostkey));
+ }
+- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ xxx_conn_info) != 0)
+ fatal("Host key verification failed.");
+ return 0;
+@@ -216,16 +216,16 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
+ }
+
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+- const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++ u_short port, const struct ssh_conn_info *cinfo)
+ {
+ char *myproposal[PROPOSAL_MAX];
+ char *all_key, *hkalgs = NULL;
+ int r, use_known_hosts_order = 0;
+
+- xxx_host = host;
+- xxx_hostaddr = hostaddr;
+- xxx_conn_info = cinfo;
++ xxx_host = xstrdup(host);
++ xxx_hostaddr = *hostaddr;
++ xxx_conn_info = ssh_conn_info_dup(cinfo);
+
+ if (options.rekey_limit || options.rekey_interval)
+ ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -248,8 +248,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+ fatal_fr(r, "kex_assemble_namelist");
+ free(all_key);
+
+- if (use_known_hosts_order)
+- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++ if (use_known_hosts_order) {
++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++ port, cinfo);
++ }
+
+ kex_proposal_populate_entries(ssh, myproposal,
+ options.kex_algorithms, options.ciphers, options.macs,
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index dba0dcaa8a..d3d00b994d 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -30,6 +30,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
+ file://CVE-2026-60002.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
* [OE-core][wrynose][PATCH 3/8] openssh: Fix CVE-2026-59998
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 17:55 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
In-Reply-To: <20260720175518.3546447-1-devanshp@cisco.com>
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59998. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432
[2] https://www.cve.org/CVERecord?id=CVE-2026-59998
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59998.patch | 36 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
new file mode 100644
index 0000000000..3e15fe19fa
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
@@ -0,0 +1,36 @@
+From 94a089cd331eeea77ffd6fd715e61d281c3b97c3 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 24 Jun 2026 06:55:12 +0000
+Subject: [PATCH] upstream: mention a caveat regarding
+ GSSAPIStrictAcceptorCheck in
+
+some environments
+
+OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2
+
+CVE: CVE-2026-59998
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision and Mdocdate-only hunks in
+ sshd_config.5 and retained the Wrynose OpenSSH 10.3p1 values because
+ this stable backport carries only the security-relevant documentation.
+
+(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sshd_config.5 | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sshd_config.5 b/sshd_config.5
+index 3f5e29812..22b9039d2 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -769,6 +769,7 @@ machine's default store.
+ This facility is provided to assist with operation on multi homed machines.
+ The default is
+ .Cm yes .
++This option may not be effective in Windows Active Directory environments.
+ .It Cm HostbasedAcceptedAlgorithms
+ Specifies the signature algorithms that will be accepted for hostbased
+ authentication as a list of comma-separated patterns.
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 87bd417b2d..b9f2a37c57 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -26,6 +26,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
+ file://CVE-2026-59998.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
--
2.35.6
^ permalink raw reply related
page: next (older)
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox