public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Zoltan Fridrich <zfridric@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/openssh] f43: Fix CVE-2026-59996
Date: Fri, 17 Jul 2026 13:34:20 GMT [thread overview]
Message-ID: <178429526016.1.511627031847492366.rpms-openssh-d9170248ffa8@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/openssh
Branch : f43
Commit : d9170248ffa89b9f50733b672198dbb4ab647fbc
Author : Zoltan Fridrich <zfridric@redhat.com>
Date : 2026-07-17T11:46:50+02:00
Stats : +23/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/openssh/c/d9170248ffa89b9f50733b672198dbb4ab647fbc?branch=f43
Log:
Fix CVE-2026-59996
Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs
remote-to-remote copy via the local host
Resolves: rhbz#2498027
Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
diff --git a/0060-openssh-9.9p1-scp-remote-glob.patch b/0060-openssh-9.9p1-scp-remote-glob.patch
new file mode 100644
index 0000000..c08101e
--- /dev/null
+++ b/0060-openssh-9.9p1-scp-remote-glob.patch
@@ -0,0 +1,14 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c 2026-07-14 11:40:47.754600847 +0200
++++ b/scp.c 2026-07-14 11:43:04.077524517 +0200
+@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
+ goto out;
+ }
+
++ /* Special handling for source of '..' */
++ if (strcmp(filename, "..") == 0)
++ filename = "."; /* Download to dest, not dest/.. */
++
+ if (targetisdir)
+ abs_dst = sftp_path_append(target, filename);
+ else
diff --git a/openssh.spec b/openssh.spec
index dae1ddf..35c35bd 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
Summary: An open source implementation of SSH protocol version 2
Name: openssh
Version: %{openssh_ver}
-Release: 10%{?dist}
+Release: 11%{?dist}
URL: http://www.openssh.com/portable.html
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -194,6 +194,8 @@ Patch0058: 0058-openssh-9.9p1-reject-null-char-in-url-string.patch
# upstream 607bd871ec029e9aa22e632a22547250f3cae223
# upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
Patch0059: 0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch
+# upstream 36480181fa22f98e180b4f9e10203480c0346c78
+Patch0060: 0060-openssh-9.9p1-scp-remote-glob.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=2581
Patch1000: 1000-openssh-coverity.patch
@@ -598,6 +600,12 @@ test -f %{sysconfig_anaconda} && \
%attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
%changelog
+* Fri Jul 17 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-11
+- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
+ in unintended parent directories when scp performs remote-to-remote copy
+ via the local host
+ Resolves: rhbz#2498027
+
* Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-10
- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
FIPS known-group validation that leads to client-side denial of service
reply other threads:[~2026-07-17 13:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178429526016.1.511627031847492366.rpms-openssh-d9170248ffa8@fedoraproject.org \
--to=zfridric@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox