mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-17 17:47:02 +00:00
Code Issues Projects Releases Wiki Activity

openssh: Fix CVE-2026-59997

Browse Source 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59997. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59997

(From OE-Core rev: 171530a1066afd2d420c33d063238af7e73ee784)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Devansh Patel authored and Paul Barker committed 2026-07-30 13:21:15 +01:00
1 parent 82cf81a3e9
commit 5c16db6e87
2 files changed
+59
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
+58
View File
@@ -0,0 +1,58 @@
From 3011cbb6bb73f3f3dc90fa1d48736803fa407509 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 5 Jun 2026 08:53:07 +0000
Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp
server,
previously they were silently dropped; reported by Steve Caffrey ok deraadt@
CVE: CVE-2026-59997
Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014]
Backport Changes:
- Retained the Scarthgap session.c OpenBSD revision identifier because the
10.4 identifier does not describe the older source baseline.
OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624
(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
session.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/session.c b/session.c
index eb932b8bf..1a01ecf74 100644
--- a/session.c
+++ b/session.c
@@ -1650,21 +1650,22 @@ do_child(struct ssh *ssh, Session *s, const char *command)
exit(1);
} else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) {
extern int optind, optreset;
- int i;
- char *p, *args;
+ int sftp_argc;
+ char **sftp_argv;
setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME);
- args = xstrdup(command ? command : "sftp-server");
- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " ")))
- if (i < ARGV_MAX - 1)
- argv[i++] = p;
- argv[i] = NULL;
+ if (argv_split(command == NULL ? "sftp-server" : command,
+ &sftp_argc, &sftp_argv, 1) != 0) {
+ error("internal error: can't split internal-sftp "
+ "arguments");
+ exit(1);
+ }
optind = optreset = 1;
- __progname = argv[0];
+ __progname = sftp_argv[0];
#ifdef WITH_SELINUX
ssh_selinux_change_context("sftpd_t");
#endif
- exit(sftp_server_main(i, argv, s->pw));
+ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw));
}
fflush(NULL);
meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+1
View File
@@ -38,6 +38,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35414-CVE-2026-35387.patch \
file://CVE-2026-35388.patch \
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"