[rpms/openssh] rawhide: Fix CVE-2026-55653

[rpms/openssh] rawhide: Fix CVE-2026-55653

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : rawhide
            Commit : f4b19d1cd01baa4e5900d79cc345fbeafdb6eaaf
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T12:08:12+02:00
            Stats  : +11/-6 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/f4b19d1cd01baa4e5900d79cc345fbeafdb6eaaf?branch=rawhide

            Log:
            Fix CVE-2026-55653

Fix double free in openssh DH-GEX client path
during FIPS known-group validation that leads
to client-side denial of service

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0038-openssh-7.7p1-fips.patch b/0038-openssh-7.7p1-fips.patch
index cbc9c5e..fa61658 100644
--- a/0038-openssh-7.7p1-fips.patch
+++ b/0038-openssh-7.7p1-fips.patch
@@ -276,17 +276,18 @@ index 1c2194a8f..f9a58b955 100644
  #include <sys/types.h>
  
  #include <openssl/bn.h>
-@@ -114,6 +115,10 @@ input_kex_dh_gex_group(int type, uint32_t seq, struct ssh *ssh)
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff --git a/myproposal.h b/myproposal.h
 index d992d8b12..6433e0820 100644
 --- a/myproposal.h

diff --git a/openssh.spec b/openssh.spec
index 850753b..677e62a 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -39,7 +39,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 4%{?dist}
+Release: 5%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -514,6 +514,10 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.3p1-5
+- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
+  FIPS known-group validation that leads to client-side denial of service
+
 * Fri Jun 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.3p1-4
 - Rebuild against OpenSSL 4.0.1