[rpms/openssh] f43: Fix CVE-2026-59996

[rpms/openssh] f43: Fix CVE-2026-59996

[Zoltan Fridrich]

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f43
            Commit : d9170248ffa89b9f50733b672198dbb4ab647fbc
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-17T11:46:50+02:00
            Stats  : +23/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/d9170248ffa89b9f50733b672198dbb4ab647fbc?branch=f43

            Log:
            Fix CVE-2026-59996

Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs
remote-to-remote copy via the local host

Resolves: rhbz#2498027

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0060-openssh-9.9p1-scp-remote-glob.patch b/0060-openssh-9.9p1-scp-remote-glob.patch
new file mode 100644
index 0000000..c08101e
--- /dev/null
+++ b/0060-openssh-9.9p1-scp-remote-glob.patch
@@ -0,0 +1,14 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c	2026-07-14 11:40:47.754600847 +0200
++++ b/scp.c	2026-07-14 11:43:04.077524517 +0200
+@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
+ 			goto out;
+ 		}
+ 
++		/* Special handling for source of '..' */
++		if (strcmp(filename, "..") == 0)
++			filename = "."; /* Download to dest, not dest/.. */
++
+ 		if (targetisdir)
+ 			abs_dst = sftp_path_append(target, filename);
+ 		else

diff --git a/openssh.spec b/openssh.spec
index dae1ddf..35c35bd 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 10%{?dist}
+Release: 11%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -194,6 +194,8 @@ Patch0058: 0058-openssh-9.9p1-reject-null-char-in-url-string.patch
 # upstream 607bd871ec029e9aa22e632a22547250f3cae223
 # upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
 Patch0059: 0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch
+# upstream 36480181fa22f98e180b4f9e10203480c0346c78
+Patch0060: 0060-openssh-9.9p1-scp-remote-glob.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch1000: 1000-openssh-coverity.patch
@@ -598,6 +600,12 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Fri Jul 17 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-11
+- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
+  in unintended parent directories when scp performs remote-to-remote copy
+  via the local host
+  Resolves: rhbz#2498027
+
 * Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-10
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
   FIPS known-group validation that leads to client-side denial of service