fix: CVE-2026-73281 - openEuler-24.03-LTS-SP3-openssh-AtomGit

已开启

fix: CVE-2026-73281 - openEuler-24.03-LTS-SP3 #516

xiaoo_robot创建于 5 天前从xiaoo_robot/openssh-202608240922： fix-cve-2026-73281-openEuler-24.03-LTS-SP3 合入到 src-openeuler/openssh： openEuler-24.03-LTS-SP3

fix: CVE-2026-73281 - openEuler-24.03-LTS-SP3 #516

已开启

xiaoo_robot创建于 5 天前

从xiaoo_robot/openssh-202608240922 fix-cve-2026-73281-openEuler-24.03-LTS-SP3合入到src-openeuler/openssh openEuler-24.03-LTS-SP3

共 2 个文件变更+82-1

Abackport-CVE-2026-73281.patch+73-0

@@ -0,0 +1,73 @@
	1	+From 6a57081dc35acf3ee298108d4bc3580489608d5f Mon Sep 17 00:00:00 2001
	2	+From: "djm@openbsd.org" <djm@openbsd.org>
	3	+Date: Fri, 7 Aug 2026 05:18:05 +0000
	4	+Subject: [PATCH] upstream: Allow session-bind@openssh.com requests when the
	5	+ agent is
	6	+
	7	+locked, otherwise forwarding sessions established with an agent was locked
	8	+will be treated as local, rather than remote.
	9	+
	10	+Reported by sn0x-sharma
	11	+
	12	+OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7
	13	+Conflict: Adapt context; skipped cosmetic RCS version tag (baseline v1.316 differs from patch v1.330); removed "query" extension branch (process_ext_query/replied do not exist in baseline openssh-9.6p1)
	14	+Reference: https://github.com/openssh/openssh-portable/commit/6a57081dc35acf3ee298108d4bc3580489608d5f.patch
	15	+Conflict: Skipped cosmetic RCS version tag (baseline openssh-9.6p1 v1.316 differs from patch v1.330); removed 'query' extension branch (process_ext_query/replied do not exist in baseline, verified via grep); adapted process_extension function context (session-bind@openssh.com allowed when locked, other operations refused when locked via generic_fail label, security-rationale comment block preserved); process_message hunk (SSH_AGENTC_EXTENSION case + sshbuf_reset repositioning) applied as-is from original patch (hunk 3 passed git apply --check). Sub B1 identified missing 5-line security-rationale comment block as avoidable warning divergence; fixed in A2 retry by restoring comment block; Sub B2 confirmed with 0 errors 0 warnings.
	16	+
	17	+---
	18	+
	19	+ ssh-agent.c \| 23 ++++++++++++++++++++---
	20	+ 1 file changed, 20 insertions(+), 3 deletions(-)
	21	+
	22	+diff --git a/ssh-agent.c b/ssh-agent.c
	23	+index cbfe09a..0238a20 100644
	24	+--- a/ssh-agent.c
	25	++++ b/ssh-agent.c
	26	+@@ -1838,10 +1838,24 @@ process_extension(SocketEntry *e)
	27	+ error_fr(r, "parse");
	28	+ goto send;
	29	+ }
	30	+- if (strcmp(name, "session-bind@openssh.com") == 0)
	31	++ /*
	32	++ * This function can be called while the agent is locked to allow
	33	++ * session binds to be processed for new channels.
	34	++ * Other operations should be refused when locked.
	35	++ */
	36	++
	37	++ if (strcmp(name, "session-bind@openssh.com") == 0) {
	38	+ success = process_ext_session_bind(e);
	39	+- else
	40	++ } else if (locked) {
	41	++ debug_f("attempt to use extension \"%s\" while locked", name);
	42	++ goto generic_fail;
	43	++ } else {
	44	+ debug_f("unsupported extension \"%s\"", name);
	45	++ generic_fail:
	46	++ free(name);
	47	++ send_status(e, 0);
	48	++ return;
	49	++ }
	50	+ free(name);
	51	+ send:
	52	+ send_status(e, success);
	53	+@@ -1891,16 +1905,19 @@ process_message(u_int socknum)
	54	+
	55	+ /* check whether agent is locked */
	56	+ if (locked && type != SSH_AGENTC_UNLOCK) {
	57	+- sshbuf_reset(e->request);
	58	+ switch (type) {
	59	+ case SSH2_AGENTC_REQUEST_IDENTITIES:
	60	+ /* send empty lists */
	61	+ no_identities(e);
	62	+ break;
	63	++ case SSH_AGENTC_EXTENSION:
	64	++ process_extension(e);
	65	++ break;
	66	+ default:
	67	+ /* send a fail message for all other request types */
	68	+ send_status(e, 0);
	69	+ }
	70	++ sshbuf_reset(e->request);
	71	+ return 1;
	72	+ }
	73	+

Mopenssh.spec+9-1

	@@ -155,6 +155,7 @@ Patch6003: backport-CVE-2026-59999.patch
155	Patch6004: backport-CVE-2026-60000.patch	155	Patch6004: backport-CVE-2026-60000.patch
156	Patch6005: backport-CVE-2026-60001.patch	156	Patch6005: backport-CVE-2026-60001.patch
157	Patch6006: backport-CVE-2026-60002.patch	157	Patch6006: backport-CVE-2026-60002.patch
		158	+Patch6007: backport-CVE-2026-73281.patch
158		159
159	Requires: /sbin/nologin	160	Requires: /sbin/nologin
160	Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8	161	Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8
	@@ -191,7 +192,7 @@ Requires: openssh = %{version}-%{release}
191	%package -n pam_ssh_agent_auth	192	%package -n pam_ssh_agent_auth
192	Summary: PAM module for authentication with ssh-agent	193	Summary: PAM module for authentication with ssh-agent
193	Version: 0.10.4	194	Version: 0.10.4
194	-Release: 5.%{openssh_release}	195	+Release: 6.%{openssh_release}
195	License: BSD	196	License: BSD
196		197
197	%description	198	%description
	@@ -229,6 +230,7 @@ instance. The module is most useful for su and sudo service stacks.
229		230
230	%prep	231	%prep
231	%setup -q -a 3	232	%setup -q -a 3
		233	+%patch -P6007 -p1
232	%patch -P6000 -p1	234	%patch -P6000 -p1
233	%patch -P6001 -p1	235	%patch -P6001 -p1
234	find %{_sourcedir} -type f -exec dos2unix -q {} \;	236	find %{_sourcedir} -type f -exec dos2unix -q {} \;
	@@ -628,6 +630,12 @@ fi
628	%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*	630	%attr(0644,root,root) %{_mandir}/man8/sftp-server.8*
629		631
630	%changelog	632	%changelog
		633	+* Mon Aug 24 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 9.6p1-20
		634	+- Type:CVE
		635	+- CVE:CVE-2026-73281
		636	+- SUG:NA
		637	+- DESC:fix CVE-2026-73281
		638	+
631	* Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 9.6p1-20	639	* Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 9.6p1-20
632	- Type:CVE	640	- Type:CVE
633	- CVE:CVE-2026-60002	641	- CVE:CVE-2026-60002