[rpms/openssh] f44: Fixes for CVE-2026-59995, CVE-2026-59999, CVE-2026-73282

[rpms/openssh] f44: Fixes for CVE-2026-59995, CVE-2026-59999, CVE-2026-73282

[Dmitry Belyavskiy]

A new commit has been pushed.

Repo   : rpms/openssh
Branch : f44
Commit : cecbe49ecf249c855746f0027b4ec032b4714ea9
Author : Dmitry Belyavskiy <dbelyavs@redhat.com>
Date   : 2026-08-19T14:40:47+02:00
Stats  : +105/-1 in 4 file(s)
URL    : https://src.fedoraproject.org/rpms/openssh/c/cecbe49ecf249c855746f0027b4ec032b4714ea9?branch=f44

Log:
Fixes for CVE-2026-59995, CVE-2026-59999, CVE-2026-73282

---
diff --git a/0062-openssh-10.4p1-CVE-2026-59995.patch b/0062-openssh-10.4p1-CVE-2026-59995.patch
new file mode 100644
index 0000000..0ba8388
--- /dev/null
+++ b/0062-openssh-10.4p1-CVE-2026-59995.patch
@@ -0,0 +1,20 @@
+diff --git a/sftp.c b/sftp.c
+index 0ab9206c2..0b57e0833 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2289,13 +2289,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ 				return (-1);
+ 			}
+ 		} else {
+-			/* XXX this is wrong wrt quoting */
+-			snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+-			    global_aflag ? " -a" : "", dir,
+-			    file2 == NULL ? "" : " ",
+-			    file2 == NULL ? "" : file2);
+-			err = parse_dispatch_command(conn, cmd,
+-			    &remote_path, startdir, 1, 0);
++			err = process_get(conn, dir, file2, remote_path, 0, 0,
++			    global_aflag, 0);
+ 			free(dir);
+ 			free(startdir);
+ 			free(remote_path);

diff --git a/0063-openssh-10.4p1-CVE-2026-59999.patch b/0063-openssh-10.4p1-CVE-2026-59999.patch
new file mode 100644
index 0000000..67b203e
--- /dev/null
+++ b/0063-openssh-10.4p1-CVE-2026-59999.patch
@@ -0,0 +1,14 @@
+diff --git a/serverloop.c b/serverloop.c
+index 8a6e3db80..9d8a3429e 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
+ 		ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ 		return NULL;
+ 	}
+-	if ((options.permit_tun & mode) == 0) {
++	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
++	    auth_opts->restricted) {
+ 		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ 		    "forwarding");
+ 		return NULL;

diff --git a/0064-openssh-10.5p1-CVE-2026-73282.patch b/0064-openssh-10.5p1-CVE-2026-73282.patch
new file mode 100644
index 0000000..ab16082
--- /dev/null
+++ b/0064-openssh-10.5p1-CVE-2026-73282.patch
@@ -0,0 +1,52 @@
+diff --git a/ssh.c b/ssh.c
+index d030b548e..e9f99c433 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -1912,14 +1912,24 @@ forwarding_success(void)
+ 	}
+ }
+ 
++struct rfwd_confirm_ctx {
++	int fid;
++};
++
+ /* Callback for remote forward global requests */
+ static void
+ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
+ {
+-	struct Forward *rfwd = (struct Forward *)ctxt;
++	struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
++	struct Forward *rfwd;
+ 	u_int port;
+ 	int r;
+ 
++	if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
++		fatal_f("invalid forwarding ID %d", rctx->fid);
++	rfwd = &options.remote_forwards[rctx->fid];
++	freezero(rctx, sizeof(*rctx));
++
+ 	/* XXX verbose() on failure? */
+ 	debug("remote forward %s for: listen %s%s%d, connect %s:%d",
+ 	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
+@@ -2097,6 +2107,8 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname)
+ 
+ 	/* Initiate remote TCP/IP port forwardings. */
+ 	for (i = 0; i < options.num_remote_forwards; i++) {
++		struct rfwd_confirm_ctx *rctx;
++
+ 		debug("Remote connections from %.200s:%d forwarded to "
+ 		    "local address %.200s:%d",
+ 		    (options.remote_forwards[i].listen_path != NULL) ?
+@@ -2111,9 +2123,10 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname)
+ 		if ((options.remote_forwards[i].handle =
+ 		    channel_request_remote_forwarding(ssh,
+ 		    &options.remote_forwards[i])) >= 0) {
++			rctx = xcalloc(1, sizeof(*rctx));
++			rctx->fid = i;
+ 			client_register_global_confirm(
+-			    ssh_confirm_remote_forward,
+-			    &options.remote_forwards[i]);
++			    ssh_confirm_remote_forward, rctx);
+ 			forward_confirms_pending++;
+ 		} else if (options.exit_on_forward_failure)
+ 			fatal("Could not request remote forwarding.");

diff --git a/openssh.spec b/openssh.spec
index bebfe98..75cd814 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 13%{?dist}
+Release: 14%{?dist}
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -190,6 +190,15 @@ Patch0059: 0059-openssh-10.2p1-downgrade-useless-error-debug.patch
 Patch0060: 0060-openssh-9.9p1-scp-remote-glob.patch
 # upstream e8bdfb151a356d0171fea4194dd205fbb252be23
 Patch0061: 0061-openssh-9.9p1-cve-2026-60002.patch
+# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
+Patch0062: 0062-openssh-10.4p1-CVE-2026-59995.patch
+# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
+# upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
+# combines CVE-2026-59999 and CVE-2026-73283
+Patch0063: 0063-openssh-10.4p1-CVE-2026-59999.patch
+# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
+Patch0064: 0064-openssh-10.5p1-CVE-2026-73282.patch
+
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch1000: 1000-openssh-6.7p1-coverity.patch
 
@@ -592,6 +601,15 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
+* Wed Aug 19 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 10.0p1-14
+- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
+  file location
+- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
+  handling of forwarding and tunneling options
+- Fix CVE-2026-73282: avoid potential realloc use-after-free in the client if a
+  remote forwarding is added via the local session multiplexing socket while a
+  remote forwarding open request is pending with the server.
+
 * Fri Jul 17 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.2p1-13
 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
   in unintended parent directories when scp performs remote-to-remote copy