From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Dmitry Belyavskiy To: git-commits@fedoraproject.org Subject: [rpms/openssh] f43: Fixes for CVE-2026-59995, CVE-2026-59999, CVE-2026-73282 Date: Wed, 19 Aug 2026 12:10:24 GMT Message-ID: <178714142490.1.9414056961868015381.rpms-openssh-f76ba39285a0@fedoraproject.org> List-ID: X-Git-Repo: rpms/openssh X-Git-Branch: f43 X-Git-Rev: f76ba39285a0590c400547403c2fbad7b1b8a7ae QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvb3BlbnNzaApCcmFu Y2ggOiBmNDMKQ29tbWl0IDogZjc2YmEzOTI4NWEwNTkwYzQwMDU0NzQwM2MyZmJhZDdiMWI4YTdh ZQpBdXRob3IgOiBEbWl0cnkgQmVseWF2c2tpeSA8ZGJlbHlhdnNAcmVkaGF0LmNvbT4KRGF0ZSAg IDogMjAyNi0wOC0xOVQxNDowODoxOSswMjowMApTdGF0cyAgOiArMTA0Ly0xIGluIDQgZmlsZShz KQpVUkwgICAgOiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL29wZW5zc2gvYy9m NzZiYTM5Mjg1YTA1OTBjNDAwNTQ3NDAzYzJmYmFkN2IxYjhhN2FlP2JyYW5jaD1mNDMKCkxvZzoK Rml4ZXMgZm9yIENWRS0yMDI2LTU5OTk1LCBDVkUtMjAyNi01OTk5OSwgQ1ZFLTIwMjYtNzMyODIK Ci0tLQpkaWZmIC0tZ2l0IGEvMDA2Mi1vcGVuc3NoLTEwLjRwMS1DVkUtMjAyNi01OTk5NS5wYXRj aCBiLzAwNjItb3BlbnNzaC0xMC40cDEtQ1ZFLTIwMjYtNTk5OTUucGF0Y2gKbmV3IGZpbGUgbW9k ZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uMGJhODM4OAotLS0gL2Rldi9udWxsCisrKyBiLzAwNjIt b3BlbnNzaC0xMC40cDEtQ1ZFLTIwMjYtNTk5OTUucGF0Y2gKQEAgLTAsMCArMSwyMCBAQAorZGlm ZiAtLWdpdCBhL3NmdHAuYyBiL3NmdHAuYworaW5kZXggMGFiOTIwNmMyLi4wYjU3ZTA4MzMgMTAw NjQ0CistLS0gYS9zZnRwLmMKKysrKyBiL3NmdHAuYworQEAgLTIyODksMTMgKzIyODksOCBAQCBp bnRlcmFjdGl2ZV9sb29wKHN0cnVjdCBzZnRwX2Nvbm4gKmNvbm4sIGNoYXIgKmZpbGUxLCBjaGFy ICpmaWxlMikKKyAJCQkJcmV0dXJuICgtMSk7CisgCQkJfQorIAkJfSBlbHNlIHsKKy0JCQkvKiBY WFggdGhpcyBpcyB3cm9uZyB3cnQgcXVvdGluZyAqLworLQkJCXNucHJpbnRmKGNtZCwgc2l6ZW9m IGNtZCwgImdldCVzICVzJXMlcyIsCistCQkJICAgIGdsb2JhbF9hZmxhZyA/ICIgLWEiIDogIiIs IGRpciwKKy0JCQkgICAgZmlsZTIgPT0gTlVMTCA/ICIiIDogIiAiLAorLQkJCSAgICBmaWxlMiA9 PSBOVUxMID8gIiIgOiBmaWxlMik7CistCQkJZXJyID0gcGFyc2VfZGlzcGF0Y2hfY29tbWFuZChj b25uLCBjbWQsCistCQkJICAgICZyZW1vdGVfcGF0aCwgc3RhcnRkaXIsIDEsIDApOworKwkJCWVy ciA9IHByb2Nlc3NfZ2V0KGNvbm4sIGRpciwgZmlsZTIsIHJlbW90ZV9wYXRoLCAwLCAwLAorKwkJ CSAgICBnbG9iYWxfYWZsYWcsIDApOworIAkJCWZyZWUoZGlyKTsKKyAJCQlmcmVlKHN0YXJ0ZGly KTsKKyAJCQlmcmVlKHJlbW90ZV9wYXRoKTsKCmRpZmYgLS1naXQgYS8wMDYzLW9wZW5zc2gtMTAu NHAxLUNWRS0yMDI2LTU5OTk5LnBhdGNoIGIvMDA2My1vcGVuc3NoLTEwLjRwMS1DVkUtMjAyNi01 OTk5OS5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi42N2IyMDNlCi0t LSAvZGV2L251bGwKKysrIGIvMDA2My1vcGVuc3NoLTEwLjRwMS1DVkUtMjAyNi01OTk5OS5wYXRj aApAQCAtMCwwICsxLDE0IEBACitkaWZmIC0tZ2l0IGEvc2VydmVybG9vcC5jIGIvc2VydmVybG9v cC5jCitpbmRleCA4YTZlM2RiODAuLjlkOGEzNDI5ZSAxMDA2NDQKKy0tLSBhL3NlcnZlcmxvb3Au YworKysrIGIvc2VydmVybG9vcC5jCitAQCAtNTIzLDcgKzUyMyw4IEBAIHNlcnZlcl9yZXF1ZXN0 X3R1bihzdHJ1Y3Qgc3NoICpzc2gpCisgCQlzc2hfcGFja2V0X3NlbmRfZGVidWcoc3NoLCAiVW5z dXBwb3J0ZWQgdHVubmVsIGRldmljZSBtb2RlLiIpOworIAkJcmV0dXJuIE5VTEw7CisgCX0KKy0J aWYgKChvcHRpb25zLnBlcm1pdF90dW4gJiBtb2RlKSA9PSAwKSB7CisrCWlmICgob3B0aW9ucy5w ZXJtaXRfdHVuICYgbW9kZSkgPT0gMCB8fCBvcHRpb25zLmRpc2FibGVfZm9yd2FyZGluZyB8fAor KwkgICAgYXV0aF9vcHRzLT5yZXN0cmljdGVkKSB7CisgCQlzc2hfcGFja2V0X3NlbmRfZGVidWco c3NoLCAiU2VydmVyIGhhcyByZWplY3RlZCB0dW5uZWwgZGV2aWNlICIKKyAJCSAgICAiZm9yd2Fy ZGluZyIpOworIAkJcmV0dXJuIE5VTEw7CgpkaWZmIC0tZ2l0IGEvMDA2NC1vcGVuc3NoLTEwLjVw MS1DVkUtMjAyNi03MzI4Mi5wYXRjaCBiLzAwNjQtb3BlbnNzaC0xMC41cDEtQ1ZFLTIwMjYtNzMy ODIucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uYWIxNjA4MgotLS0g L2Rldi9udWxsCisrKyBiLzAwNjQtb3BlbnNzaC0xMC41cDEtQ1ZFLTIwMjYtNzMyODIucGF0Y2gK QEAgLTAsMCArMSw1MiBAQAorZGlmZiAtLWdpdCBhL3NzaC5jIGIvc3NoLmMKK2luZGV4IGQwMzBi NTQ4ZS4uZTlmOTljNDMzIDEwMDY0NAorLS0tIGEvc3NoLmMKKysrKyBiL3NzaC5jCitAQCAtMTkx MiwxNCArMTkxMiwyNCBAQCBmb3J3YXJkaW5nX3N1Y2Nlc3Modm9pZCkKKyAJfQorIH0KKyAKKytz dHJ1Y3QgcmZ3ZF9jb25maXJtX2N0eCB7CisrCWludCBmaWQ7CisrfTsKKysKKyAvKiBDYWxsYmFj ayBmb3IgcmVtb3RlIGZvcndhcmQgZ2xvYmFsIHJlcXVlc3RzICovCisgc3RhdGljIHZvaWQKKyBz c2hfY29uZmlybV9yZW1vdGVfZm9yd2FyZChzdHJ1Y3Qgc3NoICpzc2gsIGludCB0eXBlLCB1X2lu dDMyX3Qgc2VxLCB2b2lkICpjdHh0KQorIHsKKy0Jc3RydWN0IEZvcndhcmQgKnJmd2QgPSAoc3Ry dWN0IEZvcndhcmQgKiljdHh0OworKwlzdHJ1Y3QgcmZ3ZF9jb25maXJtX2N0eCAqcmN0eCA9IChz dHJ1Y3QgcmZ3ZF9jb25maXJtX2N0eCAqKWN0eHQ7CisrCXN0cnVjdCBGb3J3YXJkICpyZndkOwor IAl1X2ludCBwb3J0OworIAlpbnQgcjsKKyAKKysJaWYgKHJjdHgtPmZpZCA8IDAgfHwgcmN0eC0+ ZmlkID49IG9wdGlvbnMubnVtX3JlbW90ZV9mb3J3YXJkcykKKysJCWZhdGFsX2YoImludmFsaWQg Zm9yd2FyZGluZyBJRCAlZCIsIHJjdHgtPmZpZCk7CisrCXJmd2QgPSAmb3B0aW9ucy5yZW1vdGVf Zm9yd2FyZHNbcmN0eC0+ZmlkXTsKKysJZnJlZXplcm8ocmN0eCwgc2l6ZW9mKCpyY3R4KSk7Cisr CisgCS8qIFhYWCB2ZXJib3NlKCkgb24gZmFpbHVyZT8gKi8KKyAJZGVidWcoInJlbW90ZSBmb3J3 YXJkICVzIGZvcjogbGlzdGVuICVzJXMlZCwgY29ubmVjdCAlczolZCIsCisgCSAgICB0eXBlID09 IFNTSDJfTVNHX1JFUVVFU1RfU1VDQ0VTUyA/ICJzdWNjZXNzIiA6ICJmYWlsdXJlIiwKK0BAIC0y MDk3LDYgKzIxMDcsOCBAQCBzc2hfaW5pdF9mb3J3YXJkaW5nKHN0cnVjdCBzc2ggKnNzaCwgY2hh ciAqKmlmbmFtZSkKKyAKKyAJLyogSW5pdGlhdGUgcmVtb3RlIFRDUC9JUCBwb3J0IGZvcndhcmRp bmdzLiAqLworIAlmb3IgKGkgPSAwOyBpIDwgb3B0aW9ucy5udW1fcmVtb3RlX2ZvcndhcmRzOyBp KyspIHsKKysJCXN0cnVjdCByZndkX2NvbmZpcm1fY3R4ICpyY3R4OworKworIAkJZGVidWcoIlJl bW90ZSBjb25uZWN0aW9ucyBmcm9tICUuMjAwczolZCBmb3J3YXJkZWQgdG8gIgorIAkJICAgICJs b2NhbCBhZGRyZXNzICUuMjAwczolZCIsCisgCQkgICAgKG9wdGlvbnMucmVtb3RlX2ZvcndhcmRz W2ldLmxpc3Rlbl9wYXRoICE9IE5VTEwpID8KK0BAIC0yMTExLDkgKzIxMjMsMTAgQEAgc3NoX2lu aXRfZm9yd2FyZGluZyhzdHJ1Y3Qgc3NoICpzc2gsIGNoYXIgKippZm5hbWUpCisgCQlpZiAoKG9w dGlvbnMucmVtb3RlX2ZvcndhcmRzW2ldLmhhbmRsZSA9CisgCQkgICAgY2hhbm5lbF9yZXF1ZXN0 X3JlbW90ZV9mb3J3YXJkaW5nKHNzaCwKKyAJCSAgICAmb3B0aW9ucy5yZW1vdGVfZm9yd2FyZHNb aV0pKSA+PSAwKSB7CisrCQkJcmN0eCA9IHhjYWxsb2MoMSwgc2l6ZW9mKCpyY3R4KSk7CisrCQkJ cmN0eC0+ZmlkID0gaTsKKyAJCQljbGllbnRfcmVnaXN0ZXJfZ2xvYmFsX2NvbmZpcm0oCistCQkJ ICAgIHNzaF9jb25maXJtX3JlbW90ZV9mb3J3YXJkLAorLQkJCSAgICAmb3B0aW9ucy5yZW1vdGVf Zm9yd2FyZHNbaV0pOworKwkJCSAgICBzc2hfY29uZmlybV9yZW1vdGVfZm9yd2FyZCwgcmN0eCk7 CisgCQkJZm9yd2FyZF9jb25maXJtc19wZW5kaW5nKys7CisgCQl9IGVsc2UgaWYgKG9wdGlvbnMu ZXhpdF9vbl9mb3J3YXJkX2ZhaWx1cmUpCisgCQkJZmF0YWwoIkNvdWxkIG5vdCByZXF1ZXN0IHJl bW90ZSBmb3J3YXJkaW5nLiIpOwoKZGlmZiAtLWdpdCBhL29wZW5zc2guc3BlYyBiL29wZW5zc2gu c3BlYwppbmRleCBkYmRjZjAxLi4xOTQwY2E5IDEwMDY0NAotLS0gYS9vcGVuc3NoLnNwZWMKKysr IGIvb3BlbnNzaC5zcGVjCkBAIC00Myw3ICs0Myw3IEBACiBTdW1tYXJ5OiBBbiBvcGVuIHNvdXJj ZSBpbXBsZW1lbnRhdGlvbiBvZiBTU0ggcHJvdG9jb2wgdmVyc2lvbiAyCiBOYW1lOiBvcGVuc3No CiBWZXJzaW9uOiAle29wZW5zc2hfdmVyfQotUmVsZWFzZTogMTElez9kaXN0fQorUmVsZWFzZTog MTIlez9kaXN0fQogVVJMOiBodHRwOi8vd3d3Lm9wZW5zc2guY29tL3BvcnRhYmxlLmh0bWwKIFNv dXJjZTA6IGZ0cDovL2Z0cC5vcGVuYnNkLm9yZy9wdWIvT3BlbkJTRC9PcGVuU1NIL3BvcnRhYmxl L29wZW5zc2gtJXt2ZXJzaW9ufS50YXIuZ3oKIFNvdXJjZTE6IGZ0cDovL2Z0cC5vcGVuYnNkLm9y Zy9wdWIvT3BlbkJTRC9PcGVuU1NIL3BvcnRhYmxlL29wZW5zc2gtJXt2ZXJzaW9ufS50YXIuZ3ou YXNjCkBAIC0xOTgsNiArMTk4LDE0IEBAIFBhdGNoMDA1OTogMDA1OS1vcGVuc3NoLTEwLjBwMS1y ZWplY3QtY250cmwtY2hhcnMtaW4tdXNlcm5hbWUucGF0Y2gKIFBhdGNoMDA2MDogMDA2MC1vcGVu c3NoLTkuOXAxLXNjcC1yZW1vdGUtZ2xvYi5wYXRjaAogIyB1cHN0cmVhbSBlOGJkZmIxNTFhMzU2 ZDAxNzFmZWE0MTk0ZGQyMDVmYmIyNTJiZTIzCiBQYXRjaDAwNjE6IDAwNjEtb3BlbnNzaC05Ljlw MS1jdmUtMjAyNi02MDAwMi5wYXRjaAorIyB1cHN0cmVhbSA2YTU3MDgxZGMzNWFjZjNlZTI5ODEw OGQ0YmMzNTgwNDg5NjA4ZDVmCitQYXRjaDAwNjI6IDAwNjItb3BlbnNzaC0xMC40cDEtQ1ZFLTIw MjYtNTk5OTUucGF0Y2gKKyMgdXBzdHJlYW0gOGRmZTdlZDZlMmZkOTg4ZGUwOGRmNTA4MzU1YTE5 NmI5NTZiMjc1MworIyB1cHN0cmVhbSBkMzIyZjJjY2Y3ZGEwOTVjZTk0ZDFkOTljYjU2MzI0NmY2 MTQ4N2IwCisjIGNvbWJpbmVzIENWRS0yMDI2LTU5OTk5IGFuZCBDVkUtMjAyNi03MzI4MworUGF0 Y2gwMDYzOiAwMDYzLW9wZW5zc2gtMTAuNHAxLUNWRS0yMDI2LTU5OTk5LnBhdGNoCisjIHVwc3Ry ZWFtIDk5MTBkNWVmNTMxMjRjZTExNTdkNTdiYzExZTIyMjY1OGFhNDEyOTkKK1BhdGNoMDA2NDog MDA2NC1vcGVuc3NoLTEwLjVwMS1DVkUtMjAyNi03MzI4Mi5wYXRjaAogCiAjaHR0cHM6Ly9idWd6 aWxsYS5taW5kcm90Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjU4MQogUGF0Y2gxMDAwOiAxMDAwLW9w ZW5zc2gtY292ZXJpdHkucGF0Y2gKQEAgLTYwMiw2ICs2MTAsMTUgQEAgdGVzdCAtZiAle3N5c2Nv bmZpZ19hbmFjb25kYX0gJiYgXAogJWF0dHIoMDc1NSxyb290LHJvb3QpICV7X2xpYmRpcn0vc3No dGVzdC9zay1kdW1teS5zbwogCiAlY2hhbmdlbG9nCisqIFdlZCBBdWcgMTkgMjAyNiBEbWl0cnkg QmVseWF2c2tpeSA8ZGJlbHlhdnNAcmVkaGF0LmNvbT4gLSAxMC4wcDEtMTIKKy0gRml4IENWRS0y MDI2LTU5OTk1IE9wZW5TU0g6IHNmdHAgY2xpZW50IGFsbG93cyBhdHRhY2tlciB0byBjb250cm9s IGRvd25sb2FkZWQKKyAgZmlsZSBsb2NhdGlvbgorLSBGaXggQ1ZFLTIwMjYtNTk5OTkgYW5kIENW RS0yMDI2LTczMjgzOiBTZWN1cml0eSBieXBhc3MgZHVlIHRvIGluY29ycmVjdAorICBoYW5kbGlu ZyBvZiBmb3J3YXJkaW5nIGFuZCB0dW5uZWxpbmcgb3B0aW9ucworLSBGaXggQ1ZFLTIwMjYtNzMy ODI6IGF2b2lkIHBvdGVudGlhbCByZWFsbG9jIHVzZS1hZnRlci1mcmVlIGluIHRoZSBjbGllbnQg aWYgYQorICByZW1vdGUgZm9yd2FyZGluZyBpcyBhZGRlZCB2aWEgdGhlIGxvY2FsIHNlc3Npb24g bXVsdGlwbGV4aW5nIHNvY2tldCB3aGlsZSBhCisgIHJlbW90ZSBmb3J3YXJkaW5nIG9wZW4gcmVx dWVzdCBpcyBwZW5kaW5nIHdpdGggdGhlIHNlcnZlci4KKwogKiBGcmkgSnVsIDE3IDIwMjYgWm9s dGFuIEZyaWRyaWNoIDx6ZnJpZHJpY0ByZWRoYXQuY29tPiAtIDEwLjBwMS0xMQogLSBDVkUtMjAy Ni01OTk5NjogRml4IHJlbW90ZSBnbG9iIHJlc3VsdCBvZiAiLi4iIGNhdXNpbmcgZmlsZXMgdG8g YmUgcGxhY2VkCiAgIGluIHVuaW50ZW5kZWQgcGFyZW50IGRpcmVjdG9yaWVzIHdoZW4gc2NwIHBl cmZvcm1zIHJlbW90ZS10by1yZW1vdGUgY29weQo=