diff --git a/openssh-8.3p1-fix-desynchronised-utimes-failed.patch b/10003-openssh-8.3p1-fix-desynchronised-utimes-failed.patch similarity index 100% rename from openssh-8.3p1-fix-desynchronised-utimes-failed.patch rename to 10003-openssh-8.3p1-fix-desynchronised-utimes-failed.patch diff --git a/openssh-8.0p1-sw.patch b/10004-openssh-8.0p1-sw.patch similarity index 100% rename from openssh-8.0p1-sw.patch rename to 10004-openssh-8.0p1-sw.patch diff --git a/openssh-8.0p1-CVE-2025-26465.patch b/openssh-8.0p1-CVE-2025-26465.patch new file mode 100644 index 0000000000000000000000000000000000000000..6ab2a389caf060bbe3edc67a2d2ae465f3a89b71 --- /dev/null +++ b/openssh-8.0p1-CVE-2025-26465.patch @@ -0,0 +1,57 @@ +diff --git a/openssh-8.0p1/krl.c b/openssh-8.0p1/krl.c +index 8e2d5d5..e5b046d 100644 +--- a/openssh-8.0p1/krl.c ++++ b/openssh-8.0p1/krl.c +@@ -676,6 +676,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf) + break; + case KRL_SECTION_CERT_SERIAL_BITMAP: + if (rs->lo - bitmap_start > INT_MAX) { ++ r = SSH_ERR_INVALID_FORMAT; + error("%s: insane bitmap gap", __func__); + goto out; + } +@@ -1011,6 +1012,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp, + goto out; + + if ((krl = ssh_krl_init()) == NULL) { ++ r = SSH_ERR_ALLOC_FAIL; + error("%s: alloc failed", __func__); + goto out; + } +diff --git a/openssh-8.0p1/sshconnect2.c b/openssh-8.0p1/sshconnect2.c +index ce855eb..9650b24 100644 +--- a/openssh-8.0p1/sshconnect2.c ++++ b/openssh-8.0p1/sshconnect2.c +@@ -95,7 +95,7 @@ struct sockaddr *xxx_hostaddr; + static int + verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh) + { +- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1) ++ if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) != 0) + fatal("Host key verification failed."); + return 0; + } +@@ -767,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + + if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) { + debug("%s: server sent unknown pkalg %s", __func__, pkalg); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) { +@@ -777,6 +778,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + error("input_userauth_pk_ok: type mismatch " + "for decoded key (received %d, expected %d)", + key->type, pktype); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + +@@ -796,6 +798,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh) + SSH_FP_DEFAULT); + error("%s: server replied with unknown key: %s %s", __func__, + sshkey_type(key), fp == NULL ? "" : fp); ++ r = SSH_ERR_INVALID_FORMAT; + goto done; + } + ident = format_identity(id); diff --git a/openssh.spec b/openssh.spec index 807fda845c582516f6c15e32945321e7f8db452d..268831083889e7560a1859e24223f75152691595 100644 --- a/openssh.spec +++ b/openssh.spec @@ -67,7 +67,7 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 8.0p1 -%global openssh_rel 25 +%global openssh_rel 26 %global pam_ssh_agent_ver 0.10.3 %global pam_ssh_agent_rel 7 @@ -295,6 +295,8 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch Patch1020: openssh-8.7p1-scp-kill-switch.patch #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c Patch1021: openssh-8.0p1-upstream-ignore-SIGPIPE.patch +#upstream commit 0832aac79517611dd4de93ad0a83577994d9c907 +Patch1022: openssh-8.0p1-CVE-2025-26465.patch Patch10001: 10001-openssh-8.1p1-seccomp-nanosleep.patch @@ -302,9 +304,9 @@ Patch10001: 10001-openssh-8.1p1-seccomp-nanosleep.patch # fix error: seccomp_filter sandbox not supported on loongarch64-Anolis-linux-gnu Patch10002: 10000-openssh-anolis-fix-seccomp-error.patch # End -Patch10003: openssh-8.3p1-fix-desynchronised-utimes-failed.patch +Patch10003: 10003-openssh-8.3p1-fix-desynchronised-utimes-failed.patch -Patch20000: openssh-8.0p1-sw.patch +Patch10004: 10004-openssh-8.0p1-sw.patch License: BSD Group: Applications/Internet @@ -553,10 +555,11 @@ popd %patch1019 -p1 -b .cve-2023-51385 %patch1020 -p1 -b .scp-kill-switch %patch1021 -p1 -b .ignore-SIGPIPE +%patch1022 -p2 -b .cve-2025-26465 %patch10001 -p1 %patch10002 -p1 %patch10003 -p1 -%patch20000 -p1 +%patch10004 -p1 autoreconf pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver} @@ -842,13 +845,18 @@ getent passwd sshd >/dev/null || \ %endif %changelog -* Wed Aug 28 2024 Weitao Zhou - 8.0p1-25.0.1 +* Thu Oct 09 2025 Weitao Zhou - 8.0p1-26.0.1 - seccomp: Allow check_nanosleep to better compatibility for both glibc2.28 and glibc2.32 - Support loongarch64 seccomp_filter sandbox (xuezhixin@uniontech.com) - another case where a utimes() failure could make scp send (jiang.yong5@zte.com.cn) - add sw patch (nijie@wxiat.com) - adapt macro `seccomp_audit_arch` to kernel-headers. (Weisson@linux.alibaba.com) +* Wed Aug 20 2025 Antonio Vieiro - 8.0p1-26 +- Fix missing invalid error code checks in OpenSSH. It prevents + a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465) + Resolves: RHEL-109228 + * Tue Jun 25 2024 Stepan Broz - 8.0p1-25 - Upstream: Ignore SIGPIPE earlier in main() Resolves: RHEL-37743