[packages/libssh2] Rel 3; backport publickey fixes for CVE-2026-58050 and CVE-2026-58051

[arekm]

commit 24e3261de675b5de920722a6d1ccc6de076b2c30
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Fri Aug 7 19:13:25 2026 +0200

    Rel 3; backport publickey fixes for CVE-2026-58050 and CVE-2026-58051

 CVE-2026-58050.patch | 25 +++++++++++++++++++++++++
 CVE-2026-58051.patch | 18 ++++++++++++++++++
 libssh2.spec         |  6 +++++-
 3 files changed, 48 insertions(+), 1 deletion(-)
---
diff --git a/libssh2.spec b/libssh2.spec
index 388f1cb..c2c052b 100644
--- a/libssh2.spec
+++ b/libssh2.spec
@@ -2,7 +2,7 @@ Summary:	Library implementing the SSH2 protocol
 Summary(pl.UTF-8):	Biblioteka implementująca protokół SSH2
 Name:		libssh2
 Version:	1.11.1
-Release:	2
+Release:	3
 License:	BSD
 Group:		Libraries
 Source0:	https://libssh2.org/download/%{name}-%{version}.tar.gz
@@ -12,6 +12,8 @@ Patch1:		CVE-2025-15661.patch
 Patch2:		CVE-2026-55199.patch
 Patch3:		CVE-2026-55200.patch
 Patch4:		CVE-2026-7598.patch
+Patch5:		CVE-2026-58050.patch
+Patch6:		CVE-2026-58051.patch
 URL:		https://libssh2.org/
 BuildRequires:	autoconf >= 2.59
 BuildRequires:	automake
@@ -126,6 +128,8 @@ Biblioteka statyczna libssh2.
 %patch -P2 -p1
 %patch -P3 -p1
 %patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
 
 %build
 %{__libtoolize}
diff --git a/CVE-2026-58050.patch b/CVE-2026-58050.patch
new file mode 100644
index 0000000..b4e7596
--- /dev/null
+++ b/CVE-2026-58050.patch
@@ -0,0 +1,25 @@
+From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit at vsz.me>
+Date: Sun, 28 Jun 2026 02:12:52 +0200
+Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
+ `libssh2_publickey_list_fetch()`
+
+Cap list size at 1024 elements.
+
+Upstream uses the post-1.11.1 ssh2_err()/SSH2_ALLOC() names; adjusted here
+to the 1.11.1 spellings.
+
+--- libssh2-1.11.1.orig/src/publickey.c
++++ libssh2-1.11.1/src/publickey.c
+@@ -1114,6 +1114,11 @@
+                 }
+ 
+                 if(list[keys].num_attrs) {
++                    if(list[keys].num_attrs > 1024) {
++                        _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
++                                       "Too many publickey attributes");
++                        goto err_exit;
++                    }
+                     list[keys].attrs =
+                         LIBSSH2_ALLOC(session,
+                                       list[keys].num_attrs *
diff --git a/CVE-2026-58051.patch b/CVE-2026-58051.patch
new file mode 100644
index 0000000..b60a401
--- /dev/null
+++ b/CVE-2026-58051.patch
@@ -0,0 +1,18 @@
+From a9758da45a52bc8c630ec9493804d0c6ea30b24a Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <vszakats at users.noreply.github.com>
+Date: Mon, 29 Jun 2026 19:12:21 +0200
+Subject: [PATCH] publickey: fix potential arbitrary free in
+ `libssh2_publickey_list_fetch()` (#2127)
+
+Due to uninitialized list entry.
+
+--- libssh2-1.11.1.orig/src/publickey.c
++++ libssh2-1.11.1/src/publickey.c
+@@ -972,6 +972,7 @@
+                     goto err_exit;
+                 }
+                 list = newlist;
++                memset(&list[keys], 0, sizeof(list[keys]));
+             }
+             if(pkey->version == 1) {
+                 unsigned long comment_len;
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/libssh2.git/commitdiff/24e3261de675b5de920722a6d1ccc6de076b2c30