[rpms/openssh] f44: Fix CVE-2026-55655

[rpms/openssh] f44: Fix CVE-2026-55655

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f44
            Commit : 2bcb451960fa702fbc9c9e00940c74030a86e8ce
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T13:14:56+02:00
            Stats  : +10/-7 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/2bcb451960fa702fbc9c9e00940c74030a86e8ce?branch=f44

            Log:
            Fix CVE-2026-55655

Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0006-openssh-7.2p2-x11.patch b/0006-openssh-7.2p2-x11.patch
index dceef7b..7591be5 100644
--- a/0006-openssh-7.2p2-x11.patch
+++ b/0006-openssh-7.2p2-x11.patch
@@ -11,7 +11,7 @@ diff --git a/channels.c b/channels.c
 index 80014ff34..5ce6bd400 100644
 --- a/channels.c
 +++ b/channels.c
-@@ -5169,11 +5169,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+@@ -5178,11 +5178,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  }
  
  static int
@@ -26,7 +26,7 @@ index 80014ff34..5ce6bd400 100644
  	sock = socket(AF_UNIX, SOCK_STREAM, 0);
  	if (sock == -1) {
  		error("socket: %.100s", strerror(errno));
-@@ -5181,11 +5183,12 @@ connect_local_xsocket_path(const char *pathname)
+@@ -5190,11 +5192,12 @@ connect_local_xsocket_path(const char *pathname)
  	}
  	memset(&addr, 0, sizeof(addr));
  	addr.sun_family = AF_UNIX;
@@ -42,7 +42,7 @@ index 80014ff34..5ce6bd400 100644
  	return -1;
  }
  
-@@ -5193,8 +5196,18 @@ static int
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -51,10 +51,11 @@ index 80014ff34..5ce6bd400 100644
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;

diff --git a/openssh.spec b/openssh.spec
index 297039c..b30285f 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -597,6 +597,8 @@ test -f %{sysconfig_anaconda} && \
   FIPS known-group validation that leads to client-side denial of service
 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
   cleanup due to missing NULL terminator
+- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
+  pre-binding
 
 * Thu Apr 30 2026 Manuel Fombuena <fombuena@outlook.com> - 10.2p1-10
 - Fix error message when fetching certs and keys on PKCS11 smartcards