public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Zoltan Fridrich <zfridric@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/openssh] rawhide: Fix CVE-2026-55655
Date: Tue, 07 Jul 2026 11:40:38 GMT	[thread overview]
Message-ID: <178342443880.1.17432345120054081836.rpms-openssh-fdea50ab12e0@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : rawhide
            Commit : fdea50ab12e005f274ff8e4aa6f1210730e866f8
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T12:10:55+02:00
            Stats  : +8/-5 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/fdea50ab12e005f274ff8e4aa6f1210730e866f8?branch=rawhide

            Log:
            Fix CVE-2026-55655

Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0008-openssh-7.2p2-x11.patch b/0008-openssh-7.2p2-x11.patch
index 8f92375..055c596 100644
--- a/0008-openssh-7.2p2-x11.patch
+++ b/0008-openssh-7.2p2-x11.patch
@@ -42,7 +42,7 @@ index d7c55fc89..71cc67d17 100644
  	return -1;
  }
  
-@@ -5202,8 +5205,18 @@ static int
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -51,10 +51,11 @@ index d7c55fc89..71cc67d17 100644
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;

diff --git a/openssh.spec b/openssh.spec
index 19efd63..5986a53 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -519,6 +519,8 @@ test -f %{sysconfig_anaconda} && \
   FIPS known-group validation that leads to client-side denial of service
 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
   cleanup due to missing NULL terminator
+- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
+  pre-binding
 
 * Fri Jun 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.3p1-4
 - Rebuild against OpenSSL 4.0.1

                 reply	other threads:[~2026-07-07 11:40 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178342443880.1.17432345120054081836.rpms-openssh-fdea50ab12e0@fedoraproject.org \
    --to=zfridric@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox