From 36962d5dd4f8531636b3a76cdcc377602d37757b Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Tue, 18 Feb 2025 15:05:43 +0100 Subject: [PATCH 1/5] Fixes for CVE-2025-26465, CVE-2025-26466 and also some minor regressions --- openssh-9.9p1-match-regression.patch | 10 +- openssh-9.9p2-error_processing.patch | 152 +++++++++++++++++++++++++++ openssh.spec | 15 ++- 3 files changed, 173 insertions(+), 4 deletions(-) create mode 100644 openssh-9.9p2-error_processing.patch diff --git a/openssh-9.9p1-match-regression.patch b/openssh-9.9p1-match-regression.patch index d724401..73ea964 100644 --- a/openssh-9.9p1-match-regression.patch +++ b/openssh-9.9p1-match-regression.patch @@ -137,7 +137,7 @@ index 89b8413e..dd774f46 100644 /* Terminate on comment */ if (*attrib == '#') { argv_consume(acp); /* mark all arguments consumed */ -@@ -1062,11 +1063,13 @@ match_cfg_line(const char *full_line, int *acp, char ***avp, +@@ -1062,16 +1063,20 @@ match_cfg_line(const char *full_line, int *acp, char ***avp, *arg != '\0' && *arg != '#')) { error("'all' cannot be combined with other " "Match attributes"); @@ -153,6 +153,14 @@ index 89b8413e..dd774f46 100644 } /* Criterion "invalid-user" also has no argument */ if (strcasecmp(attrib, "invalid-user") == 0) { +- if (ci == NULL) ++ if (ci == NULL) { ++ result = 0; + continue; ++ } + if (ci->user_invalid == 0) + result = 0; + else @@ -1078,11 +1081,26 @@ match_cfg_line(const char *full_line, int *acp, char ***avp, debug("matched invalid-user at line %d", line); continue; diff --git a/openssh-9.9p2-error_processing.patch b/openssh-9.9p2-error_processing.patch new file mode 100644 index 0000000..692c6ac --- /dev/null +++ b/openssh-9.9p2-error_processing.patch @@ -0,0 +1,152 @@ +diff --git a/krl.c b/krl.c +index e2efdf06..0d0f6953 100644 +--- a/krl.c ++++ b/krl.c +@@ -674,6 +674,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf) + break; + case KRL_SECTION_CERT_SERIAL_BITMAP: + if (rs->lo - bitmap_start > INT_MAX) { ++ r = SSH_ERR_INVALID_FORMAT; + error_f("insane bitmap gap"); + goto out; + } +@@ -1059,6 +1060,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp) + } + + if ((krl = ssh_krl_init()) == NULL) { ++ r = SSH_ERR_ALLOC_FAIL; + error_f("alloc failed"); + goto out; + } +diff --git a/packet.c b/packet.c +index 486f8515..9dea2cfc 100644 +--- a/packet.c ++++ b/packet.c +@@ -1864,6 +1864,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p) + if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0) + return r; + DBG(debug("Received SSH2_MSG_PING len %zu", len)); ++ if (!ssh->state->after_authentication) { ++ DBG(debug("Won't reply to PING in preauth")); ++ break; ++ } ++ if (ssh_packet_is_rekeying(ssh)) { ++ DBG(debug("Won't reply to PING during KEX")); ++ break; ++ } + if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 || + (r = sshpkt_put_string(ssh, d, len)) != 0 || + (r = sshpkt_send(ssh)) != 0) +diff --git a/ssh-agent.c b/ssh-agent.c +index 48973b2c..c27c5a95 100644 +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -1220,6 +1220,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + "restrict-destination-v00@openssh.com") == 0) { + if (*dcsp != NULL) { + error_f("%s already set", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + if ((r = sshbuf_froms(m, &b)) != 0) { +@@ -1229,6 +1230,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + while (sshbuf_len(b) != 0) { + if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) { + error_f("too many %s constraints", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + *dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1, +@@ -1246,6 +1248,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + } + if (*certs != NULL) { + error_f("%s already set", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + if ((r = sshbuf_get_u8(m, &v)) != 0 || +@@ -1257,6 +1260,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp, + while (sshbuf_len(b) != 0) { + if (*ncerts >= AGENT_MAX_EXT_CERTS) { + error_f("too many %s constraints", ext_name); ++ r = SSH_ERR_INVALID_FORMAT; + goto out; + } + *certs = xrecallocarray(*certs, *ncerts, *ncerts + 1, +@@ -1757,6 +1761,7 @@ process_ext_session_bind(SocketEntry *e) + /* record new key/sid */ + if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) { + error_f("too many session IDs recorded"); ++ r = -1; + goto out; + } + e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids, +diff --git a/ssh-sk-client.c b/ssh-sk-client.c +index 321fe53a..06fad221 100644 +--- a/ssh-sk-client.c ++++ b/ssh-sk-client.c +@@ -439,6 +439,7 @@ sshsk_load_resident(const char *provider_path, const char *device, + } + if ((srk = calloc(1, sizeof(*srk))) == NULL) { + error_f("calloc failed"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + srk->key = key; +@@ -450,6 +451,7 @@ sshsk_load_resident(const char *provider_path, const char *device, + if ((tmp = recallocarray(srks, nsrks, nsrks + 1, + sizeof(*srks))) == NULL) { + error_f("recallocarray keys failed"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + debug_f("srks[%zu]: %s %s uidlen %zu", nsrks, +diff --git a/sshconnect2.c b/sshconnect2.c +index a69c4da1..1ee6000a 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) + options.required_rsa_size)) != 0) + fatal_r(r, "Bad server host key"); + if (verify_host_key(xxx_host, xxx_hostaddr, hostkey, +- xxx_conn_info) == -1) ++ xxx_conn_info) != 0) + fatal("Host key verification failed."); + return 0; + } +@@ -699,6 +699,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + + if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) { + debug_f("server sent unknown pkalg %s", pkalg); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) { +@@ -709,6 +710,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + error("input_userauth_pk_ok: type mismatch " + "for decoded key (received %d, expected %d)", + key->type, pktype); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + +@@ -728,6 +730,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + SSH_FP_DEFAULT); + error_f("server replied with unknown key: %s %s", + sshkey_type(key), fp == NULL ? "" : fp); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + ident = format_identity(id); +diff --git a/sshsig.c b/sshsig.c +index 6e03c0b0..3da005d6 100644 +--- a/sshsig.c ++++ b/sshsig.c +@@ -879,6 +879,7 @@ cert_filter_principals(const char *path, u_long linenum, + } + if ((principals = sshbuf_dup_string(nprincipals)) == NULL) { + error_f("buffer error"); ++ r = SSH_ERR_ALLOC_FAIL; + goto out; + } + /* success */ diff --git a/openssh.spec b/openssh.spec index bf5e0e6..f6df528 100644 --- a/openssh.spec +++ b/openssh.spec @@ -39,12 +39,12 @@ %{?static_openssl:%global static_libcrypto 1} %global openssh_ver 9.9p1 -%global openssh_rel 8 +%global openssh_rel 9 Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: %{openssh_rel}%{?dist}.1 +Release: %{openssh_rel}%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -200,6 +200,9 @@ Patch1017: openssh-9.9p1-mlkembe.patch # upstream 3f02368e8e9121847727c46b280efc280e5eb615 # upstream 67a115e7a56dbdc3f5a58c64b29231151f3670f5 Patch1020: openssh-9.9p1-match-regression.patch +# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2 +# upstream 0832aac79517611dd4de93ad0a83577994d9c907 +Patch1021: openssh-9.9p2-error_processing.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -357,7 +360,6 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 951 -p1 -b .pkcs11-uri %patch -P 953 -p1 -b .scp-ipv6 %patch -P 962 -p1 -b .crypto-policies -#%patch -P 963 -p1 -b .openssl-evp %patch -P 964 -p1 -b .openssl-kdf %patch -P 965 -p1 -b .visibility %patch -P 966 -p1 -b .x11-ipv6 @@ -385,6 +387,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1016 -p1 -b .sep-keysign %patch -P 1017 -p1 -b .mlkembe %patch -P 1020 -p1 -b .match +%patch -P 1021 -p1 -b .errcode_set %patch -P 100 -p1 -b .coverity @@ -663,6 +666,12 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Tue Feb 18 2025 Dmitry Belyavskiy - 9.9p1-9 +- Fix regression of Match directive processing +- Fix missing error codes set and invalid error code checks in OpenSSH. It + prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS + is on (CVE-2025-26465, CVE-2025-26466). + * Sat Feb 01 2025 Björn Esser - 9.9p1-8.1 - Add explicit BR: libxcrypt-devel From 9cfcf4fc069c51ceaf8dda3a6c575ab91f3a21a9 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Wed, 26 Mar 2025 16:25:16 +0100 Subject: [PATCH 2/5] Remove /usr/sbin and /usr/local/sbin from the default PATH Resolves: rhbz#2354820 --- openssh.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/openssh.spec b/openssh.spec index f6df528..97c715a 100644 --- a/openssh.spec +++ b/openssh.spec @@ -39,12 +39,11 @@ %{?static_openssl:%global static_libcrypto 1} %global openssh_ver 9.9p1 -%global openssh_rel 9 Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: %{openssh_rel}%{?dist} +Release: 10%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -428,8 +427,8 @@ fi --sysconfdir=%{_sysconfdir}/ssh \ --libexecdir=%{_libexecdir}/openssh \ --datadir=%{_datadir}/openssh \ - --with-default-path=/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin \ - --with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \ + --with-default-path=/usr/local/bin:/usr/bin \ + --with-superuser-path=/usr/local/bin:/usr/bin \ --with-privsep-path=%{_datadir}/empty.sshd \ --disable-strip \ --without-zlib-version-check \ @@ -666,6 +665,10 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Wed Mar 26 2025 Dmitry Belyavskiy - 9.9p1-10 +- Remove /usr/sbin and /usr/local/sbin from the default PATH + Resolves: rhbz#2354820 + * Tue Feb 18 2025 Dmitry Belyavskiy - 9.9p1-9 - Fix regression of Match directive processing - Fix missing error codes set and invalid error code checks in OpenSSH. It From f1c4103d37a9766886bb8eed6af9737af9b067cd Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Mon, 19 May 2025 10:09:46 +0200 Subject: [PATCH 3/5] CVE-2025-32728: Fix logic error in DisableForwarding option Resolves: rhbz#2358778 Signed-off-by: Zoltan Fridrich --- openssh-9.9p1-disable-forwarding.patch | 22 ++++++++++++++++++++++ openssh.spec | 9 ++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 openssh-9.9p1-disable-forwarding.patch diff --git a/openssh-9.9p1-disable-forwarding.patch b/openssh-9.9p1-disable-forwarding.patch new file mode 100644 index 0000000..45a021e --- /dev/null +++ b/openssh-9.9p1-disable-forwarding.patch @@ -0,0 +1,22 @@ +diff --color -ruNp a/session.c b/session.c +--- a/session.c 2025-04-29 11:20:59.475107377 +0200 ++++ b/session.c 2025-04-29 11:23:16.638538968 +0200 +@@ -2284,7 +2284,8 @@ session_auth_agent_req(struct ssh *ssh, + if ((r = sshpkt_get_end(ssh)) != 0) + sshpkt_fatal(ssh, r, "%s: parse packet", __func__); + if (!auth_opts->permit_agent_forwarding_flag || +- !options.allow_agent_forwarding) { ++ !options.allow_agent_forwarding || ++ options.disable_forwarding) { + debug_f("agent forwarding disabled"); + return 0; + } +@@ -2709,7 +2710,7 @@ session_setup_x11fwd(struct ssh *ssh, Se + ssh_packet_send_debug(ssh, "X11 forwarding disabled by key options."); + return 0; + } +- if (!options.x11_forwarding) { ++ if (!options.x11_forwarding || options.disable_forwarding) { + debug("X11 forwarding disabled in server configuration file."); + return 0; + } diff --git a/openssh.spec b/openssh.spec index 97c715a..7442167 100644 --- a/openssh.spec +++ b/openssh.spec @@ -43,7 +43,7 @@ Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: 10%{?dist} +Release: 11%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -202,6 +202,8 @@ Patch1020: openssh-9.9p1-match-regression.patch # upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2 # upstream 0832aac79517611dd4de93ad0a83577994d9c907 Patch1021: openssh-9.9p2-error_processing.patch +# upstream fc86875e6acb36401dfc1dfb6b628a9d1460f367 +Patch1022: openssh-9.9p1-disable-forwarding.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -387,6 +389,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1017 -p1 -b .mlkembe %patch -P 1020 -p1 -b .match %patch -P 1021 -p1 -b .errcode_set +%patch -P 1022 -p1 -b .disable-forwarding %patch -P 100 -p1 -b .coverity @@ -665,6 +668,10 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Mon May 19 2025 Zoltan Fridrich - 9.9p1-11 +- CVE-2025-32728: Fix logic error in DisableForwarding option + Resolves: rhbz#2358778 + * Wed Mar 26 2025 Dmitry Belyavskiy - 9.9p1-10 - Remove /usr/sbin and /usr/local/sbin from the default PATH Resolves: rhbz#2354820 From e3ef73c5450c047c137bbfe9244d5f6bdbc28db9 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 8 Jan 2026 14:35:24 +0100 Subject: [PATCH 4/5] CVE-2025-61984: Reject usernames with control characters Resolves: rhbz#2402667 Signed-off-by: Zoltan Fridrich --- ...9.9p1-reject-cntrl-chars-in-username.patch | 59 +++++++++++++++++++ openssh.spec | 9 ++- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 openssh-9.9p1-reject-cntrl-chars-in-username.patch diff --git a/openssh-9.9p1-reject-cntrl-chars-in-username.patch b/openssh-9.9p1-reject-cntrl-chars-in-username.patch new file mode 100644 index 0000000..05bbe4d --- /dev/null +++ b/openssh-9.9p1-reject-cntrl-chars-in-username.patch @@ -0,0 +1,59 @@ +diff --color -ruNp a/ssh.c b/ssh.c +--- a/ssh.c 2025-12-03 15:22:36.754555231 +0100 ++++ b/ssh.c 2025-12-03 16:12:16.715320349 +0100 +@@ -662,6 +662,8 @@ valid_ruser(const char *s) + if (*s == '-') + return 0; + for (i = 0; s[i] != 0; i++) { ++ if (iscntrl((u_char)s[i])) ++ return 0; + if (strchr("'`\";&<>|(){}", s[i]) != NULL) + return 0; + /* Disallow '-' after whitespace */ +@@ -683,6 +685,7 @@ main(int ac, char **av) + struct ssh *ssh = NULL; + int i, r, opt, exit_status, use_syslog, direct, timeout_ms; + int was_addr, config_test = 0, opt_terminated = 0, want_final_pass = 0; ++ int user_on_commandline = 0; + char *p, *cp, *line, *argv0, *logfile; + char cname[NI_MAXHOST], thishost[NI_MAXHOST]; + struct stat st; +@@ -1039,8 +1042,10 @@ main(int ac, char **av) + } + break; + case 'l': +- if (options.user == NULL) ++ if (options.user == NULL) { + options.user = optarg; ++ user_on_commandline = 1; ++ } + break; + + case 'L': +@@ -1143,6 +1148,7 @@ main(int ac, char **av) + if (options.user == NULL) { + options.user = tuser; + tuser = NULL; ++ user_on_commandline = 1; + } + free(tuser); + if (options.port == -1 && tport != -1) +@@ -1157,6 +1163,7 @@ main(int ac, char **av) + if (options.user == NULL) { + options.user = p; + p = NULL; ++ user_on_commandline = 1; + } + *cp++ = '\0'; + host = xstrdup(cp); +@@ -1459,6 +1466,10 @@ main(int ac, char **av) + cinfo->locuser = xstrdup(pw->pw_name); + cinfo->jmphost = xstrdup(options.jump_host == NULL ? + "" : options.jump_host); ++ ++ if (user_on_commandline && !valid_ruser(options.user)) ++ fatal("remote username contains invalid characters"); ++ + cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost, + cinfo->remhost, cinfo->portstr, cinfo->remuser, cinfo->jmphost); + diff --git a/openssh.spec b/openssh.spec index 7442167..3905bcb 100644 --- a/openssh.spec +++ b/openssh.spec @@ -43,7 +43,7 @@ Summary: An open source implementation of SSH protocol version 2 Name: openssh Version: %{openssh_ver} -Release: 11%{?dist} +Release: 12%{?dist} URL: http://www.openssh.com/portable.html Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc @@ -204,6 +204,8 @@ Patch1020: openssh-9.9p1-match-regression.patch Patch1021: openssh-9.9p2-error_processing.patch # upstream fc86875e6acb36401dfc1dfb6b628a9d1460f367 Patch1022: openssh-9.9p1-disable-forwarding.patch +# upstream 35d5917652106aede47621bb3f64044604164043 +Patch1023: openssh-9.9p1-reject-cntrl-chars-in-username.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -390,6 +392,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1020 -p1 -b .match %patch -P 1021 -p1 -b .errcode_set %patch -P 1022 -p1 -b .disable-forwarding +%patch -P 1023 -p1 -b .reject-cntrl-chars-in-username %patch -P 100 -p1 -b .coverity @@ -668,6 +671,10 @@ test -f %{sysconfig_anaconda} && \ %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so %changelog +* Thu Jan 08 2026 Zoltan Fridrich - 9.9p1-12 +- CVE-2025-61984: Reject usernames with control characters + Resolves: rhbz#2402667 + * Mon May 19 2025 Zoltan Fridrich - 9.9p1-11 - CVE-2025-32728: Fix logic error in DisableForwarding option Resolves: rhbz#2358778 From 92f788e6849c3826ca6ae5242699f3ea24aa2ab3 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 8 Jan 2026 14:40:44 +0100 Subject: [PATCH 5/5] CVE-2025-61985: Reject URL-strings with NULL characters Resolves: rhbz#2402670 Signed-off-by: Zoltan Fridrich --- ...9.9p1-reject-null-char-in-url-string.patch | 24 +++++++++++++++++++ openssh.spec | 5 ++++ 2 files changed, 29 insertions(+) create mode 100644 openssh-9.9p1-reject-null-char-in-url-string.patch diff --git a/openssh-9.9p1-reject-null-char-in-url-string.patch b/openssh-9.9p1-reject-null-char-in-url-string.patch new file mode 100644 index 0000000..9b2d378 --- /dev/null +++ b/openssh-9.9p1-reject-null-char-in-url-string.patch @@ -0,0 +1,24 @@ +diff --color -ruNp a/misc.c b/misc.c +--- a/misc.c 2025-12-03 16:19:11.255135131 +0100 ++++ b/misc.c 2025-12-03 16:21:53.769590836 +0100 +@@ -998,7 +998,7 @@ urldecode(const char *src) + size_t srclen; + + if ((srclen = strlen(src)) >= SIZE_MAX) +- fatal_f("input too large"); ++ return NULL; + ret = xmalloc(srclen + 1); + for (dst = ret; *src != '\0'; src++) { + switch (*src) { +@@ -1006,9 +1006,10 @@ urldecode(const char *src) + *dst++ = ' '; + break; + case '%': ++ /* note: don't allow \0 characters */ + if (!isxdigit((unsigned char)src[1]) || + !isxdigit((unsigned char)src[2]) || +- (ch = hexchar(src + 1)) == -1) { ++ (ch = hexchar(src + 1)) == -1 || ch == 0) { + free(ret); + return NULL; + } diff --git a/openssh.spec b/openssh.spec index 3905bcb..956e169 100644 --- a/openssh.spec +++ b/openssh.spec @@ -206,6 +206,8 @@ Patch1021: openssh-9.9p2-error_processing.patch Patch1022: openssh-9.9p1-disable-forwarding.patch # upstream 35d5917652106aede47621bb3f64044604164043 Patch1023: openssh-9.9p1-reject-cntrl-chars-in-username.patch +# upstream 43b3bff47bb029f2299bacb6a36057981b39fdb0 +Patch1024: openssh-9.9p1-reject-null-char-in-url-string.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND sprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -393,6 +395,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1021 -p1 -b .errcode_set %patch -P 1022 -p1 -b .disable-forwarding %patch -P 1023 -p1 -b .reject-cntrl-chars-in-username +%patch -P 1024 -p1 -b .reject-null-char-in-url-string %patch -P 100 -p1 -b .coverity @@ -674,6 +677,8 @@ test -f %{sysconfig_anaconda} && \ * Thu Jan 08 2026 Zoltan Fridrich - 9.9p1-12 - CVE-2025-61984: Reject usernames with control characters Resolves: rhbz#2402667 +- CVE-2025-61985: Reject URL-strings with NULL characters + Resolves: rhbz#2402670 * Mon May 19 2025 Zoltan Fridrich - 9.9p1-11 - CVE-2025-32728: Fix logic error in DisableForwarding option