mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-01 02:30:13 +00:00
Code Issues Projects Releases Wiki Activity

openssh: Fix CVE-2026-59999

Browse Source 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59999. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59999

(From OE-Core rev: c185f00f350783e8c59b0257eb279f2f7bb0a5de)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Devansh Patel
2026-07-30 13:21:15 +01:00
committed by Paul Barker
parent 51d4fee207
commit 82cf81a3e9
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
+36
View File
@@ -0,0 +1,36 @@
From 1c719fa7d0fb0aa335f0e8d5db5d5e5d01c894e5 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Sun, 31 May 2026 04:47:29 +0000
Subject: [PATCH] upstream: DisableForwarding=yes didn't override
PermitTunnel=yes
Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
Jevtic; ok markus@
CVE: CVE-2026-59999
Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753]
Backport Changes:
- Retained the Scarthgap serverloop.c OpenBSD revision identifier because
the 10.4 identifier does not describe the older source baseline.
OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
serverloop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/serverloop.c b/serverloop.c
index f3683c2e4..c1fe99d12 100644
--- a/serverloop.c
+++ b/serverloop.c
@@ -531,7 +531,7 @@ server_request_tun(struct ssh *ssh)
ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
return NULL;
}
- if ((options.permit_tun & mode) == 0) {
+ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) {
ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
"forwarding");
return NULL;
meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+1
View File
@@ -37,6 +37,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35385.patch \
file://CVE-2026-35414-CVE-2026-35387.patch \
file://CVE-2026-35388.patch \
file://CVE-2026-59999.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"