From 8dfe7ed6e2fd988de08df508355a196b956b2753 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Sun, 31 May 2026 04:47:29 +0000 Subject: [PATCH] upstream: DisableForwarding=yes didn't override PermitTunnel=yes Reported independently by Huzaifa Sidhpurwala of Redhat and Marko Jevtic; ok markus@ OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c CVE: CVE-2026-59999 Upstream: https://github.com/openssh/openssh-portable/commit/c805b97b67c774e0bf922ffb29dfbcda9d7b5add Signed-off-by: Thomas Perale --- serverloop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/serverloop.c b/serverloop.c index 8e63480ecefa..8a6e3db8024e 100644 --- a/serverloop.c +++ b/serverloop.c @@ -498,7 +498,7 @@ server_request_tun(struct ssh *ssh) ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); return NULL; } - if ((options.permit_tun & mode) == 0) { + if ((options.permit_tun & mode) == 0 || options.disable_forwarding) { ssh_packet_send_debug(ssh, "Server has rejected tunnel device " "forwarding"); return NULL;