From 7710dd95e12ea7313ab1d00e1f234dc8dda93939 Mon Sep 17 00:00:00 2001 From: panchenbo Date: Tue, 6 Jul 2021 14:44:03 +0800 Subject: [PATCH 1/2] add strict-scp-check for CVE-2020-15778 --- add-strict-scp-check-for-CVE-2020-15778.patch | 159 ++++++++++++++++++ openssh.spec | 10 +- 2 files changed, 168 insertions(+), 1 deletion(-) create mode 100644 add-strict-scp-check-for-CVE-2020-15778.patch diff --git a/add-strict-scp-check-for-CVE-2020-15778.patch b/add-strict-scp-check-for-CVE-2020-15778.patch new file mode 100644 index 0000000..7dfd9d2 --- /dev/null +++ b/add-strict-scp-check-for-CVE-2020-15778.patch @@ -0,0 +1,159 @@ +From 2e0b74242220a97926d006719d1ac6e113918e2b Mon Sep 17 00:00:00 2001 +From: seuzw <930zhaowei@163.com> +Date: Thu, 20 May 2021 20:23:30 +0800 +Subject: [PATCH] add strict-scp-check for CVE-2020-15778 + +--- + servconf.c | 12 ++++++++++++ + servconf.h | 1 + + session.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 63 insertions(+) + +diff --git a/servconf.c b/servconf.c +index 76147f9..4e0401f 100644 +--- a/servconf.c ++++ b/servconf.c +@@ -90,6 +90,7 @@ initialize_server_options(ServerOptions *options) + { + memset(options, 0, sizeof(*options)); + ++ options->strict_scp_check = -1; + /* Portable-specific options */ + options->use_pam = -1; + +@@ -330,6 +331,8 @@ fill_default_server_options(ServerOptions *options) + _PATH_HOST_XMSS_KEY_FILE, 0); + #endif /* WITH_XMSS */ + } ++ if (options->strict_scp_check == -1) ++ options->strict_scp_check = 0; + /* No certificates by default */ + if (options->num_ports == 0) + options->ports[options->num_ports++] = SSH_DEFAULT_PORT; +@@ -540,6 +543,7 @@ fill_default_server_options(ServerOptions *options) + /* Keyword tokens. */ + typedef enum { + sBadOption, /* == unknown option */ ++ sStrictScpCheck, + /* Portable-specific options */ + sUsePAM, + /* Standard Options */ +@@ -598,6 +602,7 @@ static struct { + #else + { "usepam", sUnsupported, SSHCFG_GLOBAL }, + #endif ++ { "strictscpcheck", sStrictScpCheck, SSHCFG_GLOBAL }, + { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL }, + /* Standard Options */ + { "port", sPort, SSHCFG_GLOBAL }, +@@ -1372,6 +1377,11 @@ process_server_config_line_depth(ServerOptions *options, char *line, + /* Standard Options */ + case sBadOption: + return -1; ++ ++ case sStrictScpCheck: ++ intptr = &options->strict_scp_check; ++ goto parse_flag; ++ + case sPort: + /* ignore ports from configfile if cmdline specifies ports */ + if (options->ports_from_cmdline) +@@ -2556,6 +2566,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) + dst->n = src->n; \ + } while (0) + ++ M_CP_INTOPT(strict_scp_check); + M_CP_INTOPT(password_authentication); + M_CP_INTOPT(gss_authentication); + M_CP_INTOPT(pubkey_authentication); +@@ -2846,6 +2857,7 @@ dump_config(ServerOptions *o) + #ifdef USE_PAM + dump_cfg_fmtint(sUsePAM, o->use_pam); + #endif ++ dump_cfg_fmtint(sStrictScpCheck, o->strict_scp_check); + dump_cfg_int(sLoginGraceTime, o->login_grace_time); + dump_cfg_int(sX11DisplayOffset, o->x11_display_offset); + dump_cfg_int(sX11MaxDisplays, o->x11_max_displays); +diff --git a/servconf.h b/servconf.h +index 2c16b5a..e37dc25 100644 +--- a/servconf.h ++++ b/servconf.h +@@ -192,6 +192,7 @@ typedef struct { + * disconnect the session + */ + ++ int strict_scp_check; + u_int num_authkeys_files; /* Files containing public keys */ + char **authorized_keys_files; + +diff --git a/session.c b/session.c +index 607f17a..383c8ee 100644 +--- a/session.c ++++ b/session.c +@@ -175,6 +175,50 @@ static char *auth_sock_dir = NULL; + + /* removes the agent forwarding socket */ + ++int scp_check(const char *command) ++{ ++ debug("Entering scp check"); ++ int check = 0; ++ if (command == NULL) { ++ debug("scp check succeeded for shell mode"); ++ return check; ++ } ++ int lc = strlen(command); ++ char special_characters[] = "|;&$><`\\!\n"; ++ int ls = strlen(special_characters); ++ int count_char[128] = {0}; ++ ++ for (int i = 0; i < ls; i++) { ++ count_char[special_characters[i]] = 1; ++ } ++ ++ char scp_prefix[6] = "scp -"; ++ int lp = 5; ++ ++ if (lc <= lp) { ++ debug("scp check succeeded for length"); ++ return check; ++ } ++ ++ for (int i = 0; i < lp; i++) { ++ if (command[i] - scp_prefix[i]) { ++ debug("scp check succeeded for prefix"); ++ return check; ++ } ++ } ++ ++ for (int i = lp; i < lc; i++) { ++ if (command[i] > 0 && command[i] < 128) { ++ if (count_char[command[i]]) { ++ check = 1; ++ debug("scp check failed at %d: %c", i, command[i]); ++ break; ++ } ++ } ++ } ++ return check; ++} ++ + static void + auth_sock_cleanup_proc(struct passwd *pw) + { +@@ -696,6 +740,12 @@ do_exec(struct ssh *ssh, Session *s, const char *command) + command = auth_opts->force_command; + forced = "(key-option)"; + } ++ ++ if (options.strict_scp_check && scp_check(command)) { ++ verbose("Special characters not allowed in scp"); ++ return 1; ++ } ++ + #ifdef GSSAPI + #ifdef KRB5 /* k5users_allowed_cmds only available w/ GSSAPI+KRB5 */ + else if (k5users_allowed_cmds) { +-- +2.23.0 + diff --git a/openssh.spec b/openssh.spec index 3d8c48c..47b3e6d 100644 --- a/openssh.spec +++ b/openssh.spec @@ -6,7 +6,7 @@ %{?no_gtk2:%global gtk2 0} %global sshd_uid 74 -%global openssh_release 10 +%global openssh_release 11 Name: openssh Version: 8.2p1 @@ -90,6 +90,7 @@ Patch57: CVE-2020-12062-1.patch Patch58: CVE-2020-12062-2.patch Patch59: upstream-expose-vasnmprintf.patch Patch60: CVE-2020-14145.patch +Patch61: add-strict-scp-check-for-CVE-2020-15778.patch Requires: /sbin/nologin Requires: libselinux >= 2.3-5 audit-libs >= 1.0.8 @@ -252,6 +253,7 @@ popd %patch58 -p1 %patch59 -p1 %patch60 -p1 +%patch61 -p1 autoreconf pushd pam_ssh_agent_auth-0.10.3 @@ -464,6 +466,12 @@ getent passwd sshd >/dev/null || \ %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* %changelog +* Tue July 06 2021 panchenbo - 8.2P1-11 +- Type:cves +- CVE:CVE-2020-15778 +- SUG:NA +- DESC:add strict-scp-check for CVE-2020-15778 + * Fri May 21 2021 renmingshuai - 8.2P1-10 - Type:cves - ID:NA -- Gitee From f3d90ef3e7d9c2e82251864694d033884b8dbb60 Mon Sep 17 00:00:00 2001 From: panchenbo Date: Wed, 21 Jul 2021 10:53:44 +0800 Subject: [PATCH 2/2] fix pam_ssh_agent_auth.8.gz conflicts --- openssh.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/openssh.spec b/openssh.spec index 47b3e6d..df412de 100644 --- a/openssh.spec +++ b/openssh.spec @@ -6,7 +6,7 @@ %{?no_gtk2:%global gtk2 0} %global sshd_uid 74 -%global openssh_release 11 +%global openssh_release 12 Name: openssh Version: 8.2p1 @@ -451,7 +451,6 @@ getent passwd sshd >/dev/null || \ %files -n pam_ssh_agent_auth %license pam_ssh_agent_auth-0.10.3/OPENSSH_LICENSE %attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so -%attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8* %files help %doc ChangeLog OVERVIEW PROTOCOL* README README.privsep README.tun README.dns TODO openssh-lpk-openldap.schema @@ -466,6 +465,9 @@ getent passwd sshd >/dev/null || \ %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* %changelog +* Wed Jul 21 2021 panchenbo - 8.2P1-12 +- fix pam_ssh_agent_auth.8.gz conflicts + * Tue July 06 2021 panchenbo - 8.2P1-11 - Type:cves - CVE:CVE-2020-15778 -- Gitee