已合并
CVE-2026-73281: Apply fix patch for openEuler-24.03-LTS-SP4 #521
Qservice创建于 5 天前
CVE-2026-73281: Apply fix patch for openEuler-24.03-LTS-SP4 #521
已合并
共 2 个文件变更+71-1
| @@ -0,0 +1,63 @@ | |||
| 1 | +From 6a57081dc35acf3ee298108d4bc3580489608d5f Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: "djm@openbsd.org" <djm@openbsd.org> | ||
| 3 | +Date: Fri, 7 Aug 2026 05:18:05 +0000 | ||
| 4 | +Subject: upstream: Allow session-bind@openssh.com requests when the agent is | ||
| 5 | + locked, otherwise forwarding sessions established with an agent was locked | ||
| 6 | + will be treated as local, rather than remote. | ||
| 7 | + | ||
| 8 | +Reported by sn0x-sharma | ||
| 9 | + | ||
| 10 | +OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7 | ||
| 11 | +Conflict:Adapt context (no query extension in 9.6p1) | ||
| 12 | +Reference:https://anongit.mindrot.org/openssh.git/commit/?id=6a57081dc35acf3ee298108d4bc3580489608d5f | ||
| 13 | +--- | ||
| 14 | +--- a/ssh-agent.c | ||
| 15 | ++++ b/ssh-agent.c | ||
| 16 | + | ||
| 17 | + error_fr(r, "parse"); | ||
| 18 | + goto send; | ||
| 19 | + } | ||
| 20 | +- if (strcmp(name, "session-bind@openssh.com") == 0) | ||
| 21 | ++ /* | ||
| 22 | ++ * This function can be called while the agent is locked to allow | ||
| 23 | ++ * session binds to be processed for new channels. | ||
| 24 | ++ * Other operations should be refused when locked. | ||
| 25 | ++ */ | ||
| 26 | ++ | ||
| 27 | ++ if (strcmp(name, "session-bind@openssh.com") == 0) { | ||
| 28 | + success = process_ext_session_bind(e); | ||
| 29 | +- else | ||
| 30 | ++ } else if (locked) { | ||
| 31 | ++ debug_f("attempt to use extension \"%s\" while locked", name); | ||
| 32 | ++ goto generic_fail; | ||
| 33 | ++ } else { | ||
| 34 | + debug_f("unsupported extension \"%s\"", name); | ||
| 35 | ++ generic_fail: | ||
| 36 | ++ free(name); | ||
| 37 | ++ send_status(e, 0); | ||
| 38 | ++ return; | ||
| 39 | ++ } | ||
| 40 | + free(name); | ||
| 41 | + send: | ||
| 42 | + send_status(e, success); | ||
| 43 | + | ||
| 44 | + | ||
| 45 | + /* check whether agent is locked */ | ||
| 46 | + if (locked && type != SSH_AGENTC_UNLOCK) { | ||
| 47 | +- sshbuf_reset(e->request); | ||
| 48 | + switch (type) { | ||
| 49 | + case SSH2_AGENTC_REQUEST_IDENTITIES: | ||
| 50 | + /* send empty lists */ | ||
| 51 | + no_identities(e); | ||
| 52 | + break; | ||
| 53 | ++ case SSH_AGENTC_EXTENSION: | ||
| 54 | ++ process_extension(e); | ||
| 55 | ++ break; | ||
| 56 | + default: | ||
| 57 | + /* send a fail message for all other request types */ | ||
| 58 | + send_status(e, 0); | ||
| 59 | + } | ||
| 60 | ++ sshbuf_reset(e->request); | ||
| 61 | + return 1; | ||
| 62 | + } | ||
| 63 | + | ||
| @@ -6,7 +6,7 @@ | |||
| 6 | %{?no_gtk2:%global gtk2 0} | 6 | %{?no_gtk2:%global gtk2 0} |
| 7 | 7 | ||
| 8 | %global sshd_uid 74 | 8 | %global sshd_uid 74 |
| 9 | -%global openssh_release 23 | 9 | +%global openssh_release 24 |
| 10 | 10 | ||
| 11 | Name: openssh | 11 | Name: openssh |
| 12 | Version: 9.6p1 | 12 | Version: 9.6p1 |
| @@ -158,6 +158,7 @@ Patch6003: backport-CVE-2026-59999.patch | |||
| 158 | Patch6004: backport-CVE-2026-60000.patch | 158 | Patch6004: backport-CVE-2026-60000.patch |
| 159 | Patch6005: backport-CVE-2026-60001.patch | 159 | Patch6005: backport-CVE-2026-60001.patch |
| 160 | Patch6006: backport-CVE-2026-60002.patch | 160 | Patch6006: backport-CVE-2026-60002.patch |
| 161 | +Patch6007: backport-CVE-2026-73281.patch | ||
| 161 | 162 | ||
| 162 | Requires: /sbin/nologin | 163 | Requires: /sbin/nologin |
| 163 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 | 164 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 |
| @@ -403,6 +404,7 @@ popd | |||
| 403 | %patch -P6004 -p1 | 404 | %patch -P6004 -p1 |
| 404 | %patch -P6005 -p1 | 405 | %patch -P6005 -p1 |
| 405 | %patch -P6006 -p1 | 406 | %patch -P6006 -p1 |
| 407 | +%patch -P6007 -p1 | ||
| 406 | 408 | ||
| 407 | autoreconf | 409 | autoreconf |
| 408 | pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4 | 410 | pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4 |
| @@ -637,6 +639,11 @@ fi | |||
| 637 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* | 639 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
| 638 | 640 | ||
| 639 | %changelog | 641 | %changelog |
| 642 | +* Wed Aug 20 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 9.6p1-24 | ||
| 643 | +- Type:CVE | ||
| 644 | +- CVE:CVE-2026-73281 | ||
| 645 | +- SUG:NA | ||
| 646 | +- DESC:fix CVE-2026-73281 | ||
| 640 | * Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 9.6p1-23 | 647 | * Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 9.6p1-23 |
| 641 | - Type:CVE | 648 | - Type:CVE |
| 642 | - CVE:CVE-2026-60002 | 649 | - CVE:CVE-2026-60002 |