[rpms/openssh] f44: Fix CVE-2026-59996

[rpms/openssh] f44: Fix CVE-2026-59996

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f44
            Commit : f8fa57a96d59512c69ecda2a06f84c1f2533a57a
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-17T11:34:08+02:00
            Stats  : +23/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/f8fa57a96d59512c69ecda2a06f84c1f2533a57a?branch=f44

            Log:
            Fix CVE-2026-59996

Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs
remote-to-remote copy via the local host

Resolves: rhbz#2498027

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0060-openssh-9.9p1-scp-remote-glob.patch b/0060-openssh-9.9p1-scp-remote-glob.patch
new file mode 100644
index 0000000..c08101e
--- /dev/null
+++ b/0060-openssh-9.9p1-scp-remote-glob.patch
@@ -0,0 +1,14 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c	2026-07-14 11:40:47.754600847 +0200
++++ b/scp.c	2026-07-14 11:43:04.077524517 +0200
+@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
+ 			goto out;
+ 		}
+ 
++		/* Special handling for source of '..' */
++		if (strcmp(filename, "..") == 0)
++			filename = "."; /* Download to dest, not dest/.. */
++
+ 		if (targetisdir)
+ 			abs_dst = sftp_path_append(target, filename);
+ 		else

diff --git a/openssh.spec b/openssh.spec
index ffd8fc3..d971464 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 12%{?dist}
+Release: 13%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -186,6 +186,8 @@ Patch0057: 0057-openssh-9.9p1-authorized-keys-principles-option.patch
 Patch0058: 0058-openssh-10.2p1-proxyjump-username-validity-checks.patch
 # upstream 607f337637f2077b34a9f6f96fc24237255fe175
 Patch0059: 0059-openssh-10.2p1-downgrade-useless-error-debug.patch
+# upstream 36480181fa22f98e180b4f9e10203480c0346c78
+Patch0060: 0060-openssh-9.9p1-scp-remote-glob.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch1000: 1000-openssh-6.7p1-coverity.patch
 
@@ -588,6 +590,12 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Fri Jul 17 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.2p1-13
+- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
+  in unintended parent directories when scp performs remote-to-remote copy
+  via the local host
+  Resolves: rhbz#2498027
+
 * Tue Jul 07 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.2p1-12
 - Improve GSS KEX algorithms documentation
   Patches are submitted by xspielinbox+redhat@protonmail.com