已关闭
CVE-2026-73281: Apply fix patch for openEuler-20.03-LTS-SP4 #523
Qservice创建于 8月24日关闭于 8月31日
CVE-2026-73281: Apply fix patch for openEuler-20.03-LTS-SP4 #523
已关闭
共 2 个文件变更+39-1
| @@ -0,0 +1,31 @@ | |||
| 1 | +From 6a57081dc35acf3ee298108d4bc3580489608d5f Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: "djm@openbsd.org" <djm@openbsd.org> | ||
| 3 | +Date: Fri, 7 Aug 2026 05:18:05 +0000 | ||
| 4 | +Subject: upstream: Allow session-bind@openssh.com requests when the agent is | ||
| 5 | + locked, otherwise forwarding sessions established with an agent was locked | ||
| 6 | + will be treated as local, rather than remote. | ||
| 7 | + | ||
| 8 | +Reported by sn0x-sharma | ||
| 9 | + | ||
| 10 | +OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7 | ||
| 11 | +Conflict:Adapt context for fully-patched openEuler tree | ||
| 12 | +Reference:https://anongit.mindrot.org/openssh.git/commit/?id=6a57081dc35acf3ee298108d4bc3580489608d5f | ||
| 13 | +--- | ||
| 14 | +--- a/ssh-agent.c | ||
| 15 | ++++ b/ssh-agent.c | ||
| 16 | +@@ -871,7 +871,6 @@ | ||
| 17 | + | ||
| 18 | + /* check whether agent is locked */ | ||
| 19 | + if (locked && type != SSH_AGENTC_UNLOCK) { | ||
| 20 | +- sshbuf_reset(e->request); | ||
| 21 | + switch (type) { | ||
| 22 | + case SSH2_AGENTC_REQUEST_IDENTITIES: | ||
| 23 | + /* send empty lists */ | ||
| 24 | +@@ -881,6 +880,7 @@ | ||
| 25 | + /* send a fail message for all other request types */ | ||
| 26 | + send_status(e, 0); | ||
| 27 | + } | ||
| 28 | ++ sshbuf_reset(e->request); | ||
| 29 | + return 0; | ||
| 30 | + } | ||
| 31 | + | ||
| @@ -6,7 +6,7 @@ | |||
| 6 | %{?no_gtk2:%global gtk2 0} | 6 | %{?no_gtk2:%global gtk2 0} |
| 7 | 7 | ||
| 8 | %global sshd_uid 74 | 8 | %global sshd_uid 74 |
| 9 | -%global openssh_release 42 | 9 | +%global openssh_release 43 |
| 10 | 10 | ||
| 11 | Name: openssh | 11 | Name: openssh |
| 12 | Version: 8.2p1 | 12 | Version: 8.2p1 |
| @@ -124,6 +124,7 @@ Patch6002: backport-CVE-2026-59999.patch | |||
| 124 | Patch6003: backport-CVE-2026-60000.patch | 124 | Patch6003: backport-CVE-2026-60000.patch |
| 125 | Patch6004: backport-CVE-2026-60001.patch | 125 | Patch6004: backport-CVE-2026-60001.patch |
| 126 | Patch6005: backport-CVE-2026-60002.patch | 126 | Patch6005: backport-CVE-2026-60002.patch |
| 127 | +Patch6006: backport-CVE-2026-73281.patch | ||
| 127 | 128 | ||
| 128 | Requires: /sbin/nologin | 129 | Requires: /sbin/nologin |
| 129 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 | 130 | Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 |
| @@ -321,6 +322,7 @@ popd | |||
| 321 | %patch -P6003 -p1 | 322 | %patch -P6003 -p1 |
| 322 | %patch -P6004 -p1 | 323 | %patch -P6004 -p1 |
| 323 | %patch -P6005 -p1 | 324 | %patch -P6005 -p1 |
| 325 | +%patch -P6006 -p1 | ||
| 324 | 326 | ||
| 325 | autoreconf | 327 | autoreconf |
| 326 | pushd pam_ssh_agent_auth-0.10.3 | 328 | pushd pam_ssh_agent_auth-0.10.3 |
| @@ -530,6 +532,11 @@ getent passwd sshd >/dev/null || \ | |||
| 530 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* | 532 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
| 531 | 533 | ||
| 532 | %changelog | 534 | %changelog |
| 535 | +* Wed Aug 20 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 8.2p1-43 | ||
| 536 | +- Type:CVE | ||
| 537 | +- CVE:CVE-2026-73281 | ||
| 538 | +- SUG:NA | ||
| 539 | +- DESC:fix CVE-2026-73281 | ||
| 533 | * Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 8.2p1-42 | 540 | * Fri Aug 15 2026 xiaoo_robot <xiaoo_robot@petalmail.com> - 8.2p1-42 |
| 534 | - Type:CVE | 541 | - Type:CVE |
| 535 | - CVE:CVE-2026-60002 | 542 | - CVE:CVE-2026-60002 |