From 72f50c904f2464b75d152679f99042b794ca724a Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Fri, 22 Jan 2021 12:21:03 +0100 Subject: [PATCH 1/6] Accept empty labels (#1919007) --- openssh-8.0p1-pkcs11-uri.patch | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/openssh-8.0p1-pkcs11-uri.patch b/openssh-8.0p1-pkcs11-uri.patch index d55df23..0713ffe 100644 --- a/openssh-8.0p1-pkcs11-uri.patch +++ b/openssh-8.0p1-pkcs11-uri.patch @@ -2159,12 +2159,13 @@ index a302c79c..879fe917 100644 if (rv != CKR_OK) { error("C_GetAttributeValue failed: %lu", rv); return (NULL); -@@ -717,18 +874,19 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, +@@ -717,19 +874,19 @@ pkcs11_fetch_ecdsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, + * ensure that none of the others are zero length. * XXX assumes CKA_ID is always first. */ - if (key_attr[1].ulValueLen == 0 || +- if (key_attr[1].ulValueLen == 0 || - key_attr[2].ulValueLen == 0) { -+ key_attr[2].ulValueLen == 0 || ++ if (key_attr[2].ulValueLen == 0 || + key_attr[3].ulValueLen == 0) { error("invalid attribute length"); return (NULL); @@ -2259,12 +2260,13 @@ index a302c79c..879fe917 100644 if (rv != CKR_OK) { error("C_GetAttributeValue failed: %lu", rv); return (NULL); -@@ -838,18 +998,19 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, +@@ -838,19 +998,19 @@ pkcs11_fetch_rsa_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx, + * ensure that none of the others are zero length. * XXX assumes CKA_ID is always first. */ - if (key_attr[1].ulValueLen == 0 || +- if (key_attr[1].ulValueLen == 0 || - key_attr[2].ulValueLen == 0) { -+ key_attr[2].ulValueLen == 0 || ++ if (key_attr[2].ulValueLen == 0 || + key_attr[3].ulValueLen == 0) { error("invalid attribute length"); return (NULL); From 6c897f6328c8278649fb99ae7adc6bc52517a082 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Wed, 3 Feb 2021 17:26:30 +0100 Subject: [PATCH 2/6] 8.4p1-5 + 0.10.4-1 --- openssh.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openssh.spec b/openssh.spec index 578a2eb..d0d8890 100644 --- a/openssh.spec +++ b/openssh.spec @@ -51,7 +51,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.4p1 -%global openssh_rel 4 +%global openssh_rel 5 %global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_rel 1 @@ -669,6 +669,9 @@ test -f %{sysconfig_anaconda} && \ %endif %changelog +* Wed Feb 03 2021 Jakub Jelen - 8.4p1-5 + 0.10.4-1 +- Accept empty labels for keys from PKCS#11 (#1919007) + * Tue Dec 01 2020 Jakub Jelen - 8.4p1-4 + 0.10.4-1 - Remove "PasswordAuthentication yes" from vendor configuration as it is already default and it might be hard to override. From 144f5a6a74bfc61ae81e2ebf934b789ea12db200 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Fri, 21 May 2021 15:37:37 +0200 Subject: [PATCH 3/6] Hostbased ssh authentication fails if session ID contains a '/' Resolves: rhbz#1963059 --- openssh-7.8p1-role-mls.patch | 26 +++++++++++++------------- openssh.spec | 5 ++++- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/openssh-7.8p1-role-mls.patch b/openssh-7.8p1-role-mls.patch index add4727..ba5d23f 100644 --- a/openssh-7.8p1-role-mls.patch +++ b/openssh-7.8p1-role-mls.patch @@ -179,10 +179,10 @@ diff -up openssh/misc.c.role-mls openssh/misc.c } return NULL; } -diff -up openssh/monitor.c.role-mls openssh/monitor.c ---- openssh/monitor.c.role-mls 2018-08-20 07:57:29.000000000 +0200 -+++ openssh/monitor.c 2018-08-22 11:19:56.006844867 +0200 -@@ -115,6 +115,9 @@ int mm_answer_sign(int, struct sshbuf *) +diff -up openssh-8.6p1/monitor.c.role-mls openssh-8.6p1/monitor.c +--- openssh-8.6p1/monitor.c.role-mls 2021-04-16 05:55:25.000000000 +0200 ++++ openssh-8.6p1/monitor.c 2021-05-21 14:21:56.719414087 +0200 +@@ -117,6 +117,9 @@ int mm_answer_sign(struct ssh *, int, st int mm_answer_pwnamallow(struct ssh *, int, struct sshbuf *); int mm_answer_auth2_read_banner(struct ssh *, int, struct sshbuf *); int mm_answer_authserv(struct ssh *, int, struct sshbuf *); @@ -192,7 +192,7 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c int mm_answer_authpassword(struct ssh *, int, struct sshbuf *); int mm_answer_bsdauthquery(struct ssh *, int, struct sshbuf *); int mm_answer_bsdauthrespond(struct ssh *, int, struct sshbuf *); -@@ -189,6 +192,9 @@ struct mon_table mon_dispatch_proto20[] +@@ -195,6 +198,9 @@ struct mon_table mon_dispatch_proto20[] {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, @@ -202,7 +202,7 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, #ifdef USE_PAM -@@ -796,6 +802,9 @@ mm_answer_pwnamallow(int sock, struct ss +@@ -803,6 +809,9 @@ mm_answer_pwnamallow(struct ssh *ssh, in /* Allow service/style information on the auth context */ monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); @@ -212,7 +212,7 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); #ifdef USE_PAM -@@ -842,6 +851,26 @@ mm_answer_authserv(int sock, struct sshb +@@ -877,6 +886,26 @@ key_base_type_match(const char *method, return found; } @@ -239,7 +239,7 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c int mm_answer_authpassword(struct ssh *ssh, int sock, struct sshbuf *m) { -@@ -1218,7 +1247,7 @@ monitor_valid_userblob(u_char *data, u_i +@@ -1251,7 +1280,7 @@ monitor_valid_userblob(struct ssh *ssh, { struct sshbuf *b; const u_char *p; @@ -248,7 +248,7 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c size_t len; u_char type; int r, fail = 0; -@@ -1251,6 +1280,8 @@ monitor_valid_userblob(u_char *data, u_i +@@ -1282,6 +1311,8 @@ monitor_valid_userblob(struct ssh *ssh, fail++; if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0) fatal("%s: buffer error: %s", __func__, ssh_err(r)); @@ -257,7 +257,7 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c xasprintf(&userstyle, "%s%s%s", authctxt->user, authctxt->style ? ":" : "", authctxt->style ? authctxt->style : ""); -@@ -1286,7 +1317,7 @@ monitor_valid_hostbasedblob(u_char *data +@@ -1317,7 +1348,7 @@ monitor_valid_hostbasedblob(const u_char { struct sshbuf *b; const u_char *p; @@ -266,11 +266,11 @@ diff -up openssh/monitor.c.role-mls openssh/monitor.c size_t len; int r, fail = 0; u_char type; -@@ -1308,6 +1339,8 @@ monitor_valid_hostbasedblob(u_char *data +@@ -1338,6 +1370,8 @@ monitor_valid_hostbasedblob(const u_char fail++; if ((r = sshbuf_get_cstring(b, &cp, NULL)) != 0) - fatal("%s: buffer error: %s", __func__, ssh_err(r)); -+ if ((s = strchr(p, '/')) != NULL) + fatal("%s: buffer error: %s", __func__, ssh_err(r)); ++ if ((s = strchr(cp, '/')) != NULL) + *s = '\0'; xasprintf(&userstyle, "%s%s%s", authctxt->user, authctxt->style ? ":" : "", diff --git a/openssh.spec b/openssh.spec index d0d8890..4c5684c 100644 --- a/openssh.spec +++ b/openssh.spec @@ -51,7 +51,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.4p1 -%global openssh_rel 5 +%global openssh_rel 6 %global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_rel 1 @@ -669,6 +669,9 @@ test -f %{sysconfig_anaconda} && \ %endif %changelog +* Mon May 24 2021 Dmitry Belyavskiy - 8.4p1-6 +- Hostbased ssh authentication fails if session ID contains a '/' (#1963059) + * Wed Feb 03 2021 Jakub Jelen - 8.4p1-5 + 0.10.4-1 - Accept empty labels for keys from PKCS#11 (#1919007) From e2260da8560d324cb0c06e8e67fc88a348097937 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Thu, 17 Jun 2021 13:34:37 +0200 Subject: [PATCH 4/6] Patch for CVE-2021-28041 --- openssh-8.4p1-cve-2021-28041.patch | 11 +++++++++++ openssh.spec | 8 +++++++- 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 openssh-8.4p1-cve-2021-28041.patch diff --git a/openssh-8.4p1-cve-2021-28041.patch b/openssh-8.4p1-cve-2021-28041.patch new file mode 100644 index 0000000..6dc3000 --- /dev/null +++ b/openssh-8.4p1-cve-2021-28041.patch @@ -0,0 +1,11 @@ +diff -up openssh-8.4p1/ssh-agent.c.cve-2021-28041 openssh-8.4p1/ssh-agent.c +--- openssh-8.4p1/ssh-agent.c.cve-2021-28041 2021-06-17 13:15:58.691479334 +0200 ++++ openssh-8.4p1/ssh-agent.c 2021-06-17 13:17:16.573118348 +0200 +@@ -581,6 +581,7 @@ process_add_identity(SocketEntry *e) + goto err; + } + free(ext_name); ++ ext_name = NULL; + break; + default: + error("%s: Unknown constraint %d", __func__, ctype); diff --git a/openssh.spec b/openssh.spec index 4c5684c..d8c8203 100644 --- a/openssh.spec +++ b/openssh.spec @@ -51,7 +51,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.4p1 -%global openssh_rel 6 +%global openssh_rel 7 %global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_rel 1 @@ -201,6 +201,8 @@ Patch967: openssh-8.4p1-ssh-copy-id.patch Patch968: openssh-8.4p1-sandbox-seccomp.patch # https://bugzilla.mindrot.org/show_bug.cgi?id=3213 Patch969: openssh-8.4p1-debian-compat.patch +# https://ftp.openbsd.org/pub/OpenBSD/patches/6.8/common/015_sshagent.patch.sig +Patch970: openssh-8.4p1-cve-2021-28041.patch License: BSD Requires: /sbin/nologin @@ -387,6 +389,7 @@ popd %patch967 -p1 -b .ssh-copy-id %patch968 -p1 -b .seccomp %patch969 -p0 -b .debian +%patch970 -p1 -b .cve-2021-28041 %patch200 -p1 -b .audit %patch201 -p1 -b .audit-race @@ -669,6 +672,9 @@ test -f %{sysconfig_anaconda} && \ %endif %changelog +* Thu Jun 17 2021 Dmitry Belyavskiy - 8.4p1-7 +- Add fix to CVE-2021-28041 + * Mon May 24 2021 Dmitry Belyavskiy - 8.4p1-6 - Hostbased ssh authentication fails if session ID contains a '/' (#1963059) From 1a5f8466ab4a3faed2d4adddd10a909543def9f4 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Wed, 29 Sep 2021 13:39:26 +0200 Subject: [PATCH 5/6] Upstream fix for CVE-2021-41617 Resolves: rhbz#2008292 --- openssh-8.7p1-upstream-cve-2021-41617.patch | 25 +++++++++++++++++++++ openssh.spec | 8 ++++++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 openssh-8.7p1-upstream-cve-2021-41617.patch diff --git a/openssh-8.7p1-upstream-cve-2021-41617.patch b/openssh-8.7p1-upstream-cve-2021-41617.patch new file mode 100644 index 0000000..15d49f2 --- /dev/null +++ b/openssh-8.7p1-upstream-cve-2021-41617.patch @@ -0,0 +1,25 @@ +diff --git a/misc.c b/misc.c +index b8d1040d..0134d694 100644 +--- a/misc.c ++++ b/misc.c +@@ -56,6 +56,7 @@ + #ifdef HAVE_PATHS_H + # include + #include ++#include + #endif + #ifdef SSH_TUN_OPENBSD + #include +@@ -2695,6 +2696,12 @@ subprocess(const char *tag, const char *command, + } + closefrom(STDERR_FILENO + 1); + ++ if (geteuid() == 0 && ++ initgroups(pw->pw_name, pw->pw_gid) == -1) { ++ error("%s: initgroups(%s, %u): %s", tag, ++ pw->pw_name, (u_int)pw->pw_gid, strerror(errno)); ++ _exit(1); ++ } + if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) { + error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid, + strerror(errno)); diff --git a/openssh.spec b/openssh.spec index d8c8203..6ffa206 100644 --- a/openssh.spec +++ b/openssh.spec @@ -51,7 +51,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.4p1 -%global openssh_rel 7 +%global openssh_rel 8 %global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_rel 1 @@ -203,6 +203,8 @@ Patch968: openssh-8.4p1-sandbox-seccomp.patch Patch969: openssh-8.4p1-debian-compat.patch # https://ftp.openbsd.org/pub/OpenBSD/patches/6.8/common/015_sshagent.patch.sig Patch970: openssh-8.4p1-cve-2021-28041.patch +# CVE-2021-41617 +Patch978: openssh-8.7p1-upstream-cve-2021-41617.patch License: BSD Requires: /sbin/nologin @@ -390,6 +392,7 @@ popd %patch968 -p1 -b .seccomp %patch969 -p0 -b .debian %patch970 -p1 -b .cve-2021-28041 +%patch978 -p1 -b .cve-2021-41617 %patch200 -p1 -b .audit %patch201 -p1 -b .audit-race @@ -672,6 +675,9 @@ test -f %{sysconfig_anaconda} && \ %endif %changelog +* Wed Sep 29 2021 Dmitry Belyavskiy - 8.4p1-8 +- CVE-2021-41617 fix (#2008292) + * Thu Jun 17 2021 Dmitry Belyavskiy - 8.4p1-7 - Add fix to CVE-2021-28041 From e8a7fff21ac4c03293fb688d2ba7e13c145a57dc Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Wed, 29 Sep 2021 16:05:04 +0200 Subject: [PATCH 6/6] Upstream fix for CVE-2021-41617 Moving the fix to the proper file Resolves: rhbz#2008292 --- openssh-8.7p1-upstream-cve-2021-41617.patch | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/openssh-8.7p1-upstream-cve-2021-41617.patch b/openssh-8.7p1-upstream-cve-2021-41617.patch index 15d49f2..ec9b839 100644 --- a/openssh-8.7p1-upstream-cve-2021-41617.patch +++ b/openssh-8.7p1-upstream-cve-2021-41617.patch @@ -1,15 +1,15 @@ -diff --git a/misc.c b/misc.c +diff --git a/auth.c b/auth.c index b8d1040d..0134d694 100644 ---- a/misc.c -+++ b/misc.c +--- a/auth.c ++++ b/auth.c @@ -56,6 +56,7 @@ - #ifdef HAVE_PATHS_H # include + #endif #include +#include + #ifdef HAVE_LOGIN_H + #include #endif - #ifdef SSH_TUN_OPENBSD - #include @@ -2695,6 +2696,12 @@ subprocess(const char *tag, const char *command, } closefrom(STDERR_FILENO + 1); @@ -20,6 +20,6 @@ index b8d1040d..0134d694 100644 + pw->pw_name, (u_int)pw->pw_gid, strerror(errno)); + _exit(1); + } + /* Don't use permanently_set_uid() here to avoid fatal() */ if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) { error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid, - strerror(errno));