Hi Yoann, As requested, I have submitted the v2 change to OE-Core as a single patch.
Mailing-list archive: https://lists.openembedded.org/g/openembedded-core/message/241801 Patchwork link: https://patchwork.yoctoproject.org/project/oe-core/patch/[email protected]/ Thanks, Devansh ________________________________ From: Yoann Congal <[email protected]> Sent: Wednesday, July 22, 2026 17:03 To: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Cc: xe-linux-external (Internal Group) <[email protected]> Subject: Re: [OE-core][wrynose][PATCH 3/8] openssh: Fix CVE-2026-59998 On Wed Jul 22, 2026 at 12:02 PM CEST, Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote: > Hi Yoann, > > Thanks for pointing this out. You are correct. > > The Wrynose OpenSSH recipe does not enable the kerberos PACKAGECONFIG > by default, so it is configured with --without-kerberos5. > Consequently, GSSAPI authentication and GSSAPIStrictAcceptorCheck are > not available in the default OE-Core build, and this scenario cannot > be triggered. > > Also, the referenced upstream commit only documents the existing > Windows Active Directory behavior; it does not change or remediate > that behavior. Therefore, carrying it as a CVE fix would be > misleading. > > We will withdraw this patch and replace it with a configuration-aware > CVE_STATUS: not-applicable-config when the kerberos PACKAGECONFIG is > disabled, while leaving the CVE unpatched when Kerberos/GSSAPI support > is explicitly enabled. Sounds good. I'll send the rest of the series for review. Please send this v2 as a single patch. Thanks! > > Regards, > > Devansh > > ________________________________ > From: Yoann Congal <[email protected]> > Sent: Tuesday, July 21, 2026 20:00 > To: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) > <[email protected]>; [email protected] > <[email protected]> > Cc: xe-linux-external (Internal Group) <[email protected]> > Subject: Re: [OE-core][wrynose][PATCH 3/8] openssh: Fix CVE-2026-59998 > > On Mon Jul 20, 2026 at 7:55 PM CEST, Devansh Patel via lists.openembedded.org > wrote: >> From: Devansh Patel <[email protected]> >> >> This patch applies the upstream OpenSSH 10.4p1 backport for >> CVE-2026-59998. The upstream fix commit is referenced in [1], >> and the public CVE advisory is referenced in [2]. >> >> [1] >> https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432 >> [2] https://www.cve.org/CVERecord?id=CVE-2026-59998 >> >> Signed-off-by: Devansh Patel <[email protected]> >> --- >> .../openssh/openssh/CVE-2026-59998.patch | 36 +++++++++++++++++++ >> .../openssh/openssh_10.3p1.bb | 1 + >> 2 files changed, 37 insertions(+) >> create mode 100644 >> meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch >> >> diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch >> b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch >> new file mode 100644 >> index 0000000000..3e15fe19fa >> --- /dev/null >> +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch >> @@ -0,0 +1,36 @@ >> +From 94a089cd331eeea77ffd6fd715e61d281c3b97c3 Mon Sep 17 00:00:00 2001 >> +From: "[email protected]" <[email protected]> >> +Date: Wed, 24 Jun 2026 06:55:12 +0000 >> +Subject: [PATCH] upstream: mention a caveat regarding >> + GSSAPIStrictAcceptorCheck in >> + >> +some environments >> + >> +OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2 >> + >> +CVE: CVE-2026-59998 >> +Upstream-Status: Backport >> [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432] >> + >> +Backport Changes: >> +- Omitted the upstream OpenBSD revision and Mdocdate-only hunks in >> + sshd_config.5 and retained the Wrynose OpenSSH 10.3p1 values because >> + this stable backport carries only the security-relevant documentation. >> + >> +(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432) >> +Signed-off-by: Devansh Patel <[email protected]> >> +--- >> + sshd_config.5 | 1 + >> + 1 file changed, 1 insertion(+) >> + >> +diff --git a/sshd_config.5 b/sshd_config.5 >> +index 3f5e29812..22b9039d2 100644 >> +--- a/sshd_config.5 >> ++++ b/sshd_config.5 >> +@@ -769,6 +769,7 @@ machine's default store. >> + This facility is provided to assist with operation on multi homed machines. >> + The default is >> + .Cm yes . >> ++This option may not be effective in Windows Active Directory environments. > > This is a oneline manpage patch for "Windows Active Directory > environments.". > > I'm not expert in GSSAPI but can we even trigger this? > If not, I think this should be handled with a CVE_STATUS. > > I'll hold this patch in the meantime. > > Regards, > -- > Yoann Congal > Smile ECS -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241901): https://lists.openembedded.org/g/openembedded-core/message/241901 Mute This Topic: https://lists.openembedded.org/mt/120363508/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
