Fix CVE-2026-3497

[fscheiner]

Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex

Based on https://src.fedoraproject.org/rpms/openssh/c/f595270c4ac496ad743336e80a4f3cc11a144efb?branch=rawhide by Zoltan Fridrich zfridric@redhat.com

[fscheiner]

Untested so far. Also still unclear if the GSI functionality is affected.

[msalle]

I haven't tested it, but I'd say if it builds ok and you have tested also run-time that it works, and given that it's mostly (if not all) the fixes from RH in any case, I'd say it looks fine to me.

[fscheiner]

It works the same as before (here tested on Rocky Linux 8.x):

[johndoe@gridftp-5 gsi-openssh-testing-with-cve-fix]$ sudo ~/bin/test-gss-kex-for-gsi-openssh.bash gridftp-5.domain.tld johndoe2
gsisshd: OpenSSH_10.0p2c-GSI_hpn18.7.0 GSI, OpenSSL 1.1.1k  FIPS 25 Mar 2021
gsissh: OpenSSH_10.0p2c-GSI_hpn18.7.0 GSI, OpenSSL 1.1.1k  FIPS 25 Mar 2021

Wait 3 seconds for startup of gsisshd ...

gss-gex-sha1- OK ( plus johndoe => johndoe2 )
gss-group1-sha1- OK ( plus johndoe => johndoe2 )
gss-group14-sha256- OK ( plus johndoe => johndoe2 )
gss-nistp256-sha256- OK ( plus johndoe => johndoe2 )
gss-curve25519-sha256- OK ( plus johndoe => johndoe2 )
gss-group16-sha512- OK ( plus johndoe => johndoe2 )

...so will merge this now.