openssh: fix CVE-2025-61985

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI,
potentially leading to code execution when a ProxyCommand is used.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-61985

Upstream patch:
https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0

Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2025-61985.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2025-61985.patch
new file mode 100644 (file)
index 0000000..9f4de0e
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2025-61985.patch
@@ -0,0 +1,47 @@
+From 54928cb9eaa7143ff17f463efa7ed3109afdbf30 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 4 Sep 2025 00:30:06 +0000
+Subject: [PATCH] upstream: don't allow \0 characters in url-encoded strings.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Suggested by David Leadbeater, ok deraadt@
+
+OpenBSD-Commit-ID: c92196cef0f970ceabc1e8007a80b01e9b7cd49c
+
+Upstream-Status: Backport [Upstream commit https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0]
+CVE: CVE-2025-61985
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ misc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/misc.c b/misc.c
+index 3db2e4d0b..cac246b63 100644
+--- a/misc.c
++++ b/misc.c
+@@ -955,7 +955,7 @@ urldecode(const char *src)
+       size_t srclen;
+ 
+       if ((srclen = strlen(src)) >= SIZE_MAX)
+-              fatal_f("input too large");
++              return NULL;
+       ret = xmalloc(srclen + 1);
+       for (dst = ret; *src != '\0'; src++) {
+               switch (*src) {
+@@ -963,9 +963,10 @@ urldecode(const char *src)
+                       *dst++ = ' ';
+                       break;
+               case '%':
++                      /* note: don't allow \0 characters */
+                       if (!isxdigit((unsigned char)src[1]) ||
+                           !isxdigit((unsigned char)src[2]) ||
+-                          (ch = hexchar(src + 1)) == -1) {
++                          (ch = hexchar(src + 1)) == -1 || ch == 0) {
+                               free(ret);
+                               return NULL;
+                       }
+-- 
+2.44.1
+

diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index afcd50c7e61454c10b767e540e26a27740a5e267..bdb8a1599b75692806fb096836bbcb2136c61f14 100644 (file)
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -32,6 +32,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            file://CVE-2025-26466.patch \
            file://CVE-2025-26465.patch \
            file://CVE-2025-32728.patch \
+           file://CVE-2025-61985.patch \
            "
 SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"