From d0d5ee1547b4fc7a3b355d15262f272682465a2f Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Thu, 2 Apr 2026 07:42:16 +0000 Subject: upstream: when downloading files as root in legacy (-O) mode and without the -p (preserve modes) flag set, clear setuid/setgid bits from downloaded files as one might expect. AFAIK this bug dates back to the original Berkeley rcp program. Reported by Christos Papakonstantinou of Cantina and Spearbit. Upstream: https://salsa.debian.org/ssh-team/openssh/-/blob/bookworm/debian/patches/CVE-2026-35385.patch Upstream: https://anongit.mindrot.org/openssh.git/commit/?id=487e8ac146f7d6616f65c125d5edb210519b833a CVE: CVE-2026-35385 Signed-off-by: Thomas Perale --- scp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/scp.c b/scp.c index df590c4e3..77c854002 100644 --- a/scp.c +++ b/scp.c @@ -1684,8 +1684,10 @@ sink(int argc, char **argv, const char *src) setimes = targisdir = 0; mask = umask(0); - if (!pflag) + if (!pflag) { + mask |= 07000; (void) umask(mask); + } if (argc != 1) { run_err("ambiguous target"); exit(1);