[rpms/openssh] f43: Fix CVE-2026-55655

[rpms/openssh] f43: Fix CVE-2026-55655

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f43
            Commit : 91a6cf3969faffe7ce5804324323fb99e3496707
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-07T13:36:16+02:00
            Stats  : +10/-7 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/91a6cf3969faffe7ce5804324323fb99e3496707?branch=f43

            Log:
            Fix CVE-2026-55655

Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0007-openssh-7.2p2-x11.patch b/0007-openssh-7.2p2-x11.patch
index 2f72f9a..df37d7b 100644
--- a/0007-openssh-7.2p2-x11.patch
+++ b/0007-openssh-7.2p2-x11.patch
@@ -11,7 +11,7 @@ diff --git a/channels.c b/channels.c
 index bfe2e3b2..d46531ce 100644
 --- a/channels.c
 +++ b/channels.c
-@@ -5098,11 +5098,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
+@@ -5178,11 +5178,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
  }
  
  static int
@@ -26,7 +26,7 @@ index bfe2e3b2..d46531ce 100644
  	sock = socket(AF_UNIX, SOCK_STREAM, 0);
  	if (sock == -1) {
  		error("socket: %.100s", strerror(errno));
-@@ -5110,11 +5112,12 @@ connect_local_xsocket_path(const char *pathname)
+@@ -5190,11 +5192,12 @@ connect_local_xsocket_path(const char *pathname)
  	}
  	memset(&addr, 0, sizeof(addr));
  	addr.sun_family = AF_UNIX;
@@ -42,7 +42,7 @@ index bfe2e3b2..d46531ce 100644
  	return -1;
  }
  
-@@ -5122,8 +5125,18 @@ static int
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -51,10 +51,11 @@ index bfe2e3b2..d46531ce 100644
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;

diff --git a/openssh.spec b/openssh.spec
index 4dbb06e..dae1ddf 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -603,6 +603,8 @@ test -f %{sysconfig_anaconda} && \
   FIPS known-group validation that leads to client-side denial of service
 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
   cleanup due to missing NULL terminator
+- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
+  pre-binding
 
 * Fri Apr 17 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-9
 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol