[rpms/gsi-openssh] epel8: Based on openssh-8.0p1-33.el8_10

[Mattias Ellert <mattias.ellert@physics.uu.se>]

A new commit has been pushed.

Repo   : rpms/gsi-openssh
Branch : epel8
Commit : d3f4c7f93c6ad7d7a54ec9b3793ecec11696f658
Author : Mattias Ellert <mattias.ellert@physics.uu.se>
Date   : 2026-09-22T10:13:23+02:00
Stats  : +244/-3 in 5 file(s)
URL    : https://src.fedoraproject.org/rpms/gsi-openssh/c/d3f4c7f93c6ad7d7a54ec9b3793ecec11696f658?branch=epel8

Log:
Based on openssh-8.0p1-33.el8_10

---
diff --git a/gsi-openssh.spec b/gsi-openssh.spec
index a44f3af..435fd96 100644
--- a/gsi-openssh.spec
+++ b/gsi-openssh.spec
@@ -31,7 +31,7 @@
 %global ldap 1
 
 %global openssh_ver 8.0p1
-%global openssh_rel 19
+%global openssh_rel 20
 
 Summary: An implementation of the SSH protocol with GSI authentication
 Name: gsi-openssh
@@ -258,6 +258,12 @@ Patch1028: openssh-8.7p1-authorized-keys-principles-option.patch
 # upstream 607bd871ec029e9aa22e632a22547250f3cae223
 # upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
 Patch1029: openssh-8.0p1-proxyjump-username-validity-checks.patch
+# upstream 1b39f39657d2e58f8ec57341581a39bbf0be645b
+Patch1030: openssh-8.0p1-CVE-2026-59995.patch
+# upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
+Patch1031: openssh-8.0p1-CVE-2026-59999.patch
+# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
+Patch1032: openssh-8.0p1-CVE-2026-73282.patch
 
 # This is the patch that adds GSI support
 # Based on hpn_isshd-gsi.7.5p1b.patch from Globus upstream
@@ -457,6 +463,9 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P1027 -p1 -b .ecdsa-incomplete-application
 %patch -P1028 -p1 -b .authorized-keys-principles-option
 %patch -P1029 -p1 -b .proxyjump-username-validity-checks
+%patch -P1030 -p1 -b .cve-2026-59995
+%patch -P1031 -p1 -b .cve-2026-59999
+%patch -P1032 -p1 -b .CVE-2026-73282
 
 %patch -P98 -p1 -b .gsi
 %patch -P99 -p1 -b .hpn
@@ -659,6 +668,9 @@ getent passwd sshd >/dev/null || \
 %attr(0644,root,root) %{_tmpfilesdir}/gsissh.conf
 
 %changelog
+* Tue Sep 22 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 8.0p1-20
+- Based on openssh-8.0p1-33.el8_10
+
 * Thu Jul 09 2026 Mattias Ellert <mattias.ellert@physics.uu.se> - 8.0p1-19
 - Based on openssh-8.0p1-30.el8_10
 

diff --git a/openssh-8.0p1-CVE-2026-59995.patch b/openssh-8.0p1-CVE-2026-59995.patch
new file mode 100644
index 0000000..d7d02d9
--- /dev/null
+++ b/openssh-8.0p1-CVE-2026-59995.patch
@@ -0,0 +1,33 @@
+From 3860783959126ee4c01fabb0ae11522b1df86efb Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 29 Jun 2026 01:47:21 +0000
+Subject: [PATCH] upstream: avoid download to server-controlled path when
+ performing
+
+download on the commandline. From Swival scanner
+
+OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
+---
+ sftp.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sftp.c b/sftp.c
+index be901f5..8b7b799 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2226,13 +2226,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ 				return (-1);
+ 			}
+ 		} else {
+-			/* XXX this is wrong wrt quoting */
+-			snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+-			    global_aflag ? " -a" : "", dir,
+-			    file2 == NULL ? "" : " ",
+-			    file2 == NULL ? "" : file2);
+-			err = parse_dispatch_command(conn, cmd,
+-			    &remote_path, startdir, 1, 0);
++			err = process_get(conn, dir, file2, remote_path, 0, 0,
++			    global_aflag, 0);
+ 			free(dir);
+ 			free(startdir);
+ 			free(remote_path);

diff --git a/openssh-8.0p1-CVE-2026-59999.patch b/openssh-8.0p1-CVE-2026-59999.patch
new file mode 100644
index 0000000..5b59a79
--- /dev/null
+++ b/openssh-8.0p1-CVE-2026-59999.patch
@@ -0,0 +1,28 @@
+From 5aace1d332f0f74e7a993f04f9ab4449d6a44cb1 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 31 May 2026 04:47:29 +0000
+Subject: [PATCH] upstream: DisableForwarding=yes didn't override
+ PermitTunnel=yes
+
+Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
+Jevtic; ok markus@
+
+OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
+---
+ serverloop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/serverloop.c b/serverloop.c
+index a0df04e..8838ef1 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -585,7 +585,8 @@ server_request_tun(struct ssh *ssh)
+ 		ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ 		return NULL;
+ 	}
+-	if ((options.permit_tun & mode) == 0) {
++	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
++	    auth_opts->restricted) {
+ 		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ 		    "forwarding");
+ 		return NULL;

diff --git a/openssh-8.0p1-CVE-2026-73282.patch b/openssh-8.0p1-CVE-2026-73282.patch
new file mode 100644
index 0000000..12afab8
--- /dev/null
+++ b/openssh-8.0p1-CVE-2026-73282.patch
@@ -0,0 +1,51 @@
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2026-08-25 15:38:18.115917218 +0200
++++ b/ssh.c	2026-08-25 15:44:36.797255562 +0200
+@@ -1629,14 +1629,24 @@ fork_postauth(void)
+ 		fatal("daemon() failed: %.200s", strerror(errno));
+ }
+ 
++struct rfwd_confirm_ctx {
++	int fid;
++};
++
+ /* Callback for remote forward global requests */
+ static void
+ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
+ {
+-	struct Forward *rfwd = (struct Forward *)ctxt;
++	struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
++	struct Forward *rfwd;
+ 	u_int port;
+ 	int r;
+ 
++	if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
++		fatal("%s: invalid forwarding ID %d", __func__, rctx->fid);
++	rfwd = &options.remote_forwards[rctx->fid];
++	freezero(rctx, sizeof(*rctx));
++
+ 	/* XXX verbose() on failure? */
+ 	debug("remote forward %s for: listen %s%s%d, connect %s:%d",
+ 	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
+@@ -1762,6 +1772,8 @@ ssh_init_forwarding(struct ssh *ssh, cha
+ 
+ 	/* Initiate remote TCP/IP port forwardings. */
+ 	for (i = 0; i < options.num_remote_forwards; i++) {
++		struct rfwd_confirm_ctx *rctx;
++
+ 		debug("Remote connections from %.200s:%d forwarded to "
+ 		    "local address %.200s:%d",
+ 		    (options.remote_forwards[i].listen_path != NULL) ?
+@@ -1783,9 +1795,10 @@ ssh_init_forwarding(struct ssh *ssh, cha
+ 				logit("Warning: Could not request remote "
+ 				    "forwarding.");
+ 		} else {
++			rctx = xcalloc(1, sizeof(*rctx));
++			rctx->fid = i;
+ 			client_register_global_confirm(
+-			    ssh_confirm_remote_forward,
+-			    &options.remote_forwards[i]);
++			    ssh_confirm_remote_forward, rctx);
+ 		}
+ 	}
+ 

diff --git a/openssh-9.3p1-upstream-cve-2023-38408.patch b/openssh-9.3p1-upstream-cve-2023-38408.patch
index 5632ba1..d6498b1 100644
--- a/openssh-9.3p1-upstream-cve-2023-38408.patch
+++ b/openssh-9.3p1-upstream-cve-2023-38408.patch
@@ -1,8 +1,125 @@
+diff --git a/misc.c b/misc.c
+index e77b869be4e6..253ecd5bd3d0 100644
+--- a/misc.c
++++ b/misc.c
+@@ -22,6 +22,7 @@
+ 
+ #include <sys/types.h>
+ #include <sys/ioctl.h>
++#include <sys/mman.h>
+ #include <sys/socket.h>
+ #include <sys/stat.h>
+ #include <sys/time.h>
+@@ -35,6 +36,9 @@
+ # include <libgen.h>
+ #endif
+ #include <poll.h>
++#ifdef HAVE_NLIST_H
++#include <nlist.h>
++#endif
+ #include <signal.h>
+ #include <stdarg.h>
+ #include <stdio.h>
+@@ -2920,3 +2924,75 @@ ptimeout_isset(struct timespec *pt)
+ {
+ 	return (*path == '/') ? 1 : 0;
+ }
++
++/*
++ * Returns zero if the library at 'path' contains symbol 's', nonzero
++ * otherwise.
++ */
++int
++lib_contains_symbol(const char *path, const char *s)
++{
++#ifdef HAVE_NLIST_H
++	struct nlist nl[2];
++	int ret = -1, r;
++
++	memset(nl, 0, sizeof(nl));
++	nl[0].n_name = xstrdup(s);
++	nl[1].n_name = NULL;
++	if ((r = nlist(path, nl)) == -1) {
++		error("lib_contains_symbol: nlist failed for %s", path);
++		goto out;
++	}
++	if (r != 0 || nl[0].n_value == 0 || nl[0].n_type == 0) {
++		error("lib_contains_symbol: library %s does not contain symbol %s", path, s);
++		goto out;
++	}
++	/* success */
++	ret = 0;
++ out:
++	free(nl[0].n_name);
++	return ret;
++#else /* HAVE_NLIST_H */
++	int fd, ret = -1;
++	struct stat st;
++	void *m = NULL;
++	size_t sz = 0;
++
++	memset(&st, 0, sizeof(st));
++	if ((fd = open(path, O_RDONLY)) < 0) {
++		error("lib_contains_symbol: open %s: %s", path, strerror(errno));
++		return -1;
++	}
++	if (fstat(fd, &st) != 0) {
++		error("lib_contains_symbol: fstat %s: %s", path, strerror(errno));
++		goto out;
++	}
++	if (!S_ISREG(st.st_mode)) {
++		error("lib_contains_symbol: %s is not a regular file", path);
++		goto out;
++	}
++	if (st.st_size < 0 ||
++	    (size_t)st.st_size < strlen(s) ||
++	    st.st_size >= INT_MAX/2) {
++		error("lib_contains_symbol: %s bad size %lld", path, (long long)st.st_size);
++		goto out;
++	}
++	sz = (size_t)st.st_size;
++	if ((m = mmap(NULL, sz, PROT_READ, MAP_PRIVATE, fd, 0)) == MAP_FAILED ||
++	    m == NULL) {
++		error("lib_contains_symbol: mmap %s: %s", path, strerror(errno));
++		goto out;
++	}
++	if (memmem(m, sz, s, strlen(s)) == NULL) {
++		error("lib_contains_symbol: %s does not contain expected string %s", path, s);
++		goto out;
++	}
++	/* success */
++	ret = 0;
++ out:
++	if (m != NULL && m != MAP_FAILED)
++		munmap(m, sz);
++	close(fd);
++	return ret;
++#endif /* HAVE_NLIST_H */
++}
+diff --git a/misc.h b/misc.h
+index 07408ca13c45..fd77a7fd7273 100644
+--- a/misc.h
++++ b/misc.h
+@@ -96,6 +96,7 @@ int	 parse_absolute_time(const char *, uint64_t *);
+ int	 parse_absolute_time(const char *, uint64_t *);
+ void	 format_absolute_time(uint64_t, char *, size_t);
+ int	 path_absolute(const char *);
++int	 lib_contains_symbol(const char *, const char *);
+ 
+ void	 sock_set_v6only(int);
+ 
 diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
-index 6be647ec..ebddf6c3 100644
+index 0b51e7753882..8e2b9cb97310 100644
 --- a/ssh-pkcs11.c
 +++ b/ssh-pkcs11.c
-@@ -1537,10 +1537,8 @@ pkcs11_register_provider(char *provider_id, char *pin,
+@@ -1532,15 +1532,15 @@ pkcs11_register_provider(char *provider_id, char *pin,
+ 		m->refcount++;
+ 	}
+ 
++	if (lib_contains_symbol(provider_module, "C_GetFunctionList") != 0)
++		fatal("provider %s is not a PKCS11 library", provider_module);
+ 	/* open shared pkcs11-library */
+ 	if ((handle = dlopen(provider_module, RTLD_NOW)) == NULL) {
  		error("dlopen %s failed: %s", provider_module, dlerror());
  		goto fail;
  	}