mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
ceb0c8b082
Commit on master [1] fixed a number of vulnerabilities but the 2025.02.x
branch is still on OpenSSH v9.9p2.
This commit fixes the following vulnerabilities by backporting upstream
patches:
- CVE-2026-59995:
sftp in OpenSSH before 10.4 does not properly constrain the location
of downloaded files when "sftp server:/path ." is used with an
attacker-controlled server.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59995
- 1b39f39657
- CVE-2026-59996:
scp in OpenSSH before 10.4 may place a file in the parent directory of
an intended directory when the copy occurs between two remote
destinations.
For more information, see:
- 36480181fa
- https://www.cve.org/CVERecord?id=CVE-2026-59996
- CVE-2026-59997:
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first
9 command-line arguments, which can be important if a later command-
line argument would have helped to ensure the intended security
properties of an SFTP connection.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59997
- e9916c44c1
- CVE-2026-59999:
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to
take precedence over PermitTunnel=yes, but did not.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-59999
- c805b97b67
- CVE-2026-60000:
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial
of service (resource consumption from excessive authentication
attempts) because MaxAuthTries was mishandled for
GSSAPIAuthentication.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-60000
- 5d04ca6af7
- CVE-2026-60001:
sshd in OpenSSH before 10.4 does not always honor the minimum
authentication delay.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-60001
- d43ba60c91
- CVE-2026-60002:
ssh in OpenSSH before 10.4 can have a use-after-free when a server
changes its host key during a key re-exchange. (This outcome occurs
only on the client side.)
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-60002
- e8bdfb151a
The CVE-2026-59998 is windows specific and thus ignored.
[1] 90add0c09e package/openssh: security bump to version 10.4p1
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(alternative to commit 90add0c09e)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches