David Nyström 2142f17368 openssh: fix CVE-2025-61984 ...

ssh in OpenSSH before 10.1 allows control characters in usernames that
originate from certain possibly untrusted sources, potentially leading
to code execution when a ProxyCommand is used. The untrusted sources
are the command line and %-sequence expansion of a configuration file.

Note:
openssh does not support variable expansion until 10.0, so backport
adapts for this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-61984

Upstream patch:
35d5917652

(From OE-Core rev: 717d4c7609cdce2cc3a65b7ba69c316fa86a9333)

Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2025-10-24 06:23:40 -07:00

..

classes

cve-check: Add missing call to exit_if_errors

2025-08-22 05:59:54 -07:00

classes-global

sanity.bbclass: skip check_userns for non-local uid

2025-01-09 06:25:36 -08:00

classes-recipe

uboot: Allow for customizing installed/deployed file names

2025-07-07 07:42:58 -07:00

conf

conf/bitbake.conf: use gnu mirror instead of main server

2025-10-13 12:42:58 -07:00

files

meta: Enable '-o pipefail' for the SDK installer

2025-03-05 06:03:47 -08:00

lib

oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main server

2025-10-13 12:42:58 -07:00

recipes-bsp

grub2: mark CVE-2024-2312 as not applicable

2025-10-13 12:42:57 -07:00

recipes-connectivity

openssh: fix CVE-2025-61984

2025-10-24 06:23:40 -07:00

recipes-core

glib-networking: fix CVE-2025-60018

2025-10-24 06:23:39 -07:00

recipes-devtools

binutils: patch CVE-2025-11083

2025-10-24 06:23:39 -07:00

recipes-extended

ghostscript: patch CVE-2025-59800

2025-10-13 12:42:58 -07:00

recipes-gnome

gdk-pixbuf: fix CVE-2025-7345

2025-07-21 09:07:21 -07:00

recipes-graphics

cairo: fix build with gcc-15 on host

2025-08-22 05:59:55 -07:00

recipes-kernel

systemtap: Fix task_work_cancel build

2025-09-22 13:17:52 -07:00

recipes-multimedia

ffmpeg: ignore 8 CVEs fixed in 6.1.1 and 6.1.3 releases

2025-10-13 12:42:58 -07:00

recipes-rt

rt-tests: rt_bmark.py: fix TypeError

2024-08-06 19:11:18 -07:00

recipes-sato

puzzles: ignore three new CVEs for a different puzzles

2025-03-15 06:40:07 -07:00

recipes-support

gnupg: mark CVE-2025-30258 as patched

2025-10-24 06:23:39 -07:00

site

site: remove at-spi2-core values

2023-09-02 07:45:29 +01:00

COPYING.MIT

…

recipes.txt

…