- Fix ssh-keygen -Y find-principals -f /dev/null -s /dev/null segfault

Related: rhbz#2022336

openssh-8.7p1-find-principals-fix.patch

@@ -0,0 +1,13 @@
+diff -up openssh-8.7p1/ssh-keygen.c.find-princ openssh-8.7p1/ssh-keygen.c
+--- openssh-8.7p1/ssh-keygen.c.find-princ	2021-11-29 15:27:03.032070863 +0100
++++ openssh-8.7p1/ssh-keygen.c	2021-11-29 15:27:34.736342968 +0100
+@@ -2700,7 +2700,8 @@ sig_process_opts(char * const *opts, siz
+ 	time_t now;
+ 
+ 	*verify_timep = 0;
+-	*print_pubkey = 0;
++	if (print_pubkey)
++		*print_pubkey = 0;
+ 	for (i = 0; i < nopts; i++) {
+ 		if (strncasecmp(opts[i], "verify-time=", 12) == 0) {
+ 			if (parse_absolute_time(opts[i] + 12,

openssh-8.7p1-upstream-cve-2021-41617.patch

@@ -0,0 +1,31 @@
+diff --git a/misc.c b/misc.c
+index b8d1040d..0134d694 100644
+--- a/misc.c
++++ b/misc.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: misc.c,v 1.169 2021/08/09 23:47:44 djm Exp $ */
++/* $OpenBSD: misc.c,v 1.170 2021/09/26 14:01:03 djm Exp $ */
+ /*
+  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+  * Copyright (c) 2005-2020 Damien Miller.  All rights reserved.
+@@ -56,6 +56,7 @@
+ #ifdef HAVE_PATHS_H
+ # include <paths.h>
+ #include <pwd.h>
++#include <grp.h>
+ #endif
+ #ifdef SSH_TUN_OPENBSD
+ #include <net/if.h>
+@@ -2695,6 +2696,12 @@ subprocess(const char *tag, const char *command,
+ 		}
+ 		closefrom(STDERR_FILENO + 1);
+ 
++		if (geteuid() == 0 &&
++		    initgroups(pw->pw_name, pw->pw_gid) == -1) {
++			error("%s: initgroups(%s, %u): %s", tag,
++			    pw->pw_name, (u_int)pw->pw_gid, strerror(errno));
++			_exit(1);
++		}
+ 		if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1) {
+ 			error("%s: setresgid %u: %s", tag, (u_int)pw->pw_gid,
+ 			    strerror(errno));

openssh.spec

@@ -51,7 +51,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.7p1
-%global openssh_rel 1
+%global openssh_rel 3
 %global pam_ssh_agent_ver 0.10.4
 %global pam_ssh_agent_rel 4
 
@@ -193,6 +193,10 @@ Patch966: openssh-8.2p1-x11-without-ipv6.patch
 Patch974: openssh-8.0p1-keygen-strip-doseol.patch
 # sshd provides PAM an incorrect error code (#1879503)
 Patch975: openssh-8.0p1-preserve-pam-errors.patch
+# CVE-2021-41617
+Patch978: openssh-8.7p1-upstream-cve-2021-41617.patch
+# fix ssh-keygen -Y find-principals -f /dev/null -s /dev/null
+Patch979: openssh-8.7p1-find-principals-fix.patch
 
 License: BSD
 Requires: /sbin/nologin
@@ -369,6 +373,8 @@ popd
 %patch966 -p1 -b .x11-ipv6
 %patch974 -p1 -b .keygen-strip-doseol
 %patch975 -p1 -b .preserve-pam-errors
+%patch978 -p1 -b .cve-2021-41617
+%patch979 -p1 -b .find-princ
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-race
@@ -654,6 +660,12 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
+* Mon Nov 29 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-3
+- Fix `ssh-keygen -Y find-principals -f /dev/null -s /dev/null` segfault (#2022336)
+
+* Wed Sep 29 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-2
+- CVE-2021-41617 fix (#2008292)
+
 * Wed Sep 01 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-1 + 0.10.4-4
 - New upstream release (#1995893)