Fix: CVE-2026-35388 add missing askpass check for ssh -O proxy

A vulnerability was discovered in OpenSSH: when ControlMaster is set to
ask or autoask, "ssh -O proxy ..." did not prompt for permission before
proxying a new multiplexed connection through the master connection,
unlike other mux operations. This allowed a proxy request to be granted
without the expected user confirmation.

Signed-off-by: Lucas RAVAGNIER <lucas.ravagnier@vates.tech>

Author: Lucas RAVAGNIER

SOURCES/openssh-9.8p1-CVE-2026-35388-add-missing-askpass-check-when-using.patch

@@ -0,0 +1,48 @@
+Origin: upstream, https://github.com/openssh/openssh-portable/commit/c805b97b67c774e0bf922ffb29dfbcda9d7b5add
+Backport notes:
+- Only the "version identifier/RCS ID" in headers has been modified. 
+
+From c805b97b67c774e0bf922ffb29dfbcda9d7b5add Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 2 Apr 2026 07:39:57 +0000
+Subject: [PATCH] upstream: add missing askpass check when using
+
+ControlMaster=ask/autoask and "ssh -O proxy ..."; reported by Michalis
+Vasileiadis
+
+OpenBSD-Commit-ID: 8dd7b9b96534e9a8726916b96d36bed466d3836a
+Backported-by: Lucas Ravagnier <lucas.ravagnier@vates.tech>
+---
+ mux.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/mux.c b/mux.c
+index 5e20c7760..0cd169732 100644
+--- a/mux.c
++++ b/mux.c
+@@ -1,4 +1,4 @@
+-/* $OpenBSD: mux.c,v 1.101 2023/11/23 03:37:05 dtucker Exp $ */
++/* $OpenBSD: mux.c,v 1.113 2026/04/02 07:39:57 djm Exp $ */
+ /*
+  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
+  *
+@@ -1172,6 +1172,16 @@ mux_master_process_proxy(struct ssh *ssh, u_int rid,
+ 
+ 	debug_f("channel %d: proxy request", c->self);
+ 
++	if (options.control_master == SSHCTL_MASTER_ASK ||
++	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
++		if (!ask_permission("Allow multiplex proxy connection?")) {
++			debug2_f("proxy refused by user");
++			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
++			    "Permission denied");
++			return 0;
++		}
++	}
++
+ 	c->mux_rcb = channel_proxy_downstream;
+ 	if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
+ 	    (r = sshbuf_put_u32(reply, rid)) != 0)
+-- 
+2.54.0
+

SPECS/openssh.spec

@@ -132,6 +132,7 @@ Patch1007: openssh-9.8p1-CVE-2025-32728-Fix-logic-error-in-DisableForwarding-opt
 Patch1008: openssh-9.8p1-CVE-2025-61984-Improve-rules-for-expansion-of-username.patch
 Patch1009: openssh-9.8p1-CVE-2025-61985-don-t-allow-0-characters-in-url-encoded-str.patch
 Patch1010: openssh-9.8p1-CVE-2026-35385-when-downloading-files-as-root-in-legacy-O-.patch
+Patch1011: openssh-9.8p1-CVE-2026-35388-add-missing-askpass-check-when-using.patch
 
 Source24: ssh_config
 Source25: sshd_config
@@ -529,6 +530,8 @@ cat %{_sysconfdir}/ssh/ssh_config.dup > %{_sysconfdir}/ssh/ssh_config
 - Fix CVE-2026-35385 (files downloaded as root with scp's legacy -O mode
   but without -p did not have their setuid/setgid bits cleared, allowing
   privilege escalation)
+- Fix CVE-2026-35388 (missing askpass confirmation when using
+  ControlMaster=ask/autoask with "ssh -O proxy ...")
 
 * Wed Apr 29 2026 Vincent Michel <vincent.michel@vates.tech> - 9.8p1-1.2.4
 - Disable the use of ssh-rsa with SHA-1 (temporarily enabled in 9.8p1-1.2.2)