已关闭
CVE-2026-73281: Apply fix patch for openEuler-22.03-LTS-SP4 #522
Qservice创建于 24 天前关闭于 17 天前
CVE-2026-73281: Apply fix patch for openEuler-22.03-LTS-SP4 #522
已关闭
共 2 个文件变更+39-1
| @@ -0,0 +1,31 @@ | |||
| 1 | +From 6a57081dc35acf3ee298108d4bc3580489608d5f Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: "djm@openbsd.org" <djm@openbsd.org> | ||
| 3 | +Date: Fri, 7 Aug 2026 05:18:05 +0000 | ||
| 4 | +Subject: upstream: Allow session-bind@openssh.com requests when the agent is | ||
| 5 | + locked, otherwise forwarding sessions established with an agent was locked | ||
| 6 | + will be treated as local, rather than remote. | ||
| 7 | + | ||
| 8 | +Reported by sn0x-sharma | ||
| 9 | + | ||
| 10 | +OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7 | ||
| 11 | +Conflict:Adapt context for fully-patched openEuler tree | ||
| 12 | +Reference:https://anongit.mindrot.org/openssh.git/commit/?id=6a57081dc35acf3ee298108d4bc3580489608d5f | ||
| 13 | +--- | ||
| 14 | +--- a/ssh-agent.c | ||
| 15 | ++++ b/ssh-agent.c | ||
| 16 | + | ||
| 17 | + | ||
| 18 | + /* check whether agent is locked */ | ||
| 19 | + if (locked && type != SSH_AGENTC_UNLOCK) { | ||
| 20 | +- sshbuf_reset(e->request); | ||
| 21 | + switch (type) { | ||
| 22 | + case SSH2_AGENTC_REQUEST_IDENTITIES: | ||
| 23 | + /* send empty lists */ | ||
| 24 | + | ||
| 25 | + /* send a fail message for all other request types */ | ||
| 26 | + send_status(e, 0); | ||
| 27 | + } | ||
| 28 | ++ sshbuf_reset(e->request); | ||
| 29 | + return 1; | ||
| 30 | + } | ||
| 31 | + | ||
| @@ -6,7 +6,7 @@ | |||
| 6 | %{?no_gtk2:%global gtk2 0} | 6 | %{?no_gtk2:%global gtk2 0} |
| 7 | 7 | ||
| 8 | %global sshd_uid 74 | 8 | %global sshd_uid 74 |
| 9 | -%global openssh_release 49 | 9 | +%global openssh_release 50 |
| 10 | 10 | ||
| 11 | Name: openssh | 11 | Name: openssh |
| 12 | Version: 8.8p1 | 12 | Version: 8.8p1 |
| @@ -173,6 +173,7 @@ Patch6003: backport-CVE-2026-59999.patch | |||
| 173 | Patch6004: backport-CVE-2026-60000.patch | 173 | Patch6004: backport-CVE-2026-60000.patch |
| 174 | Patch6005: backport-CVE-2026-60001.patch | 174 | Patch6005: backport-CVE-2026-60001.patch |
| 175 | Patch6006: backport-CVE-2026-60002.patch | 175 | Patch6006: backport-CVE-2026-60002.patch |
| 176 | +Patch6007: backport-CVE-2026-73281.patch | ||
| 176 | 177 | ||
| 177 | Requires: /sbin/nologin | 178 | Requires: /sbin/nologin |
| 178 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 | 179 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 |
| @@ -397,6 +398,7 @@ popd | |||
| 397 | %patch -P6004 -p1 | 398 | %patch -P6004 -p1 |
| 398 | %patch -P6005 -p1 | 399 | %patch -P6005 -p1 |
| 399 | %patch -P6006 -p1 | 400 | %patch -P6006 -p1 |
| 401 | +%patch -P6007 -p1 | ||
| 400 | 402 | ||
| 401 | autoreconf | 403 | autoreconf |
| 402 | pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4 | 404 | pushd pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4 |
| @@ -603,6 +605,11 @@ getent passwd sshd >/dev/null || \ | |||
| 603 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* | 605 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
| 604 | 606 | ||
| 605 | %changelog | 607 | %changelog |
| 608 | +* Wed Aug 20 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 8.8p1-50 | ||
| 609 | +- Type:CVE | ||
| 610 | +- CVE:CVE-2026-73281 | ||
| 611 | +- SUG:NA | ||
| 612 | +- DESC:fix CVE-2026-73281 | ||
| 606 | * Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 8.8p1-49 | 613 | * Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 8.8p1-49 |
| 607 | - Type:CVE | 614 | - Type:CVE |
| 608 | - CVE:CVE-2026-60002 | 615 | - CVE:CVE-2026-60002 |