[packages/libssh2] Rel 4. Fixes: CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035
arekm
arekm at pld-linux.org
Sun Oct 18 02:20:18 CEST 2026
commit 2067ea54f5921db720c05b117c8ac800251b46bc
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Sun Oct 18 02:19:52 2026 +0200
Rel 4. Fixes: CVE-2026-66032, CVE-2026-66033, CVE-2026-66034,
CVE-2026-66035
CVE-2026-66032.patch | 24 ++++++++++++++++++++++++
CVE-2026-66033.patch | 40 ++++++++++++++++++++++++++++++++++++++++
CVE-2026-66034.patch | 31 +++++++++++++++++++++++++++++++
CVE-2026-66035.patch | 38 ++++++++++++++++++++++++++++++++++++++
libssh2-sftp-status.patch | 42 ++++++++++++++++++++++++++++++++++++++++++
libssh2-test-result.patch | 13 +++++++++++++
libssh2.spec | 33 +++++++++++++++++++++++++++------
7 files changed, 215 insertions(+), 6 deletions(-)
---
diff --git a/libssh2.spec b/libssh2.spec
index c2c052b..9ae601c 100644
--- a/libssh2.spec
+++ b/libssh2.spec
@@ -1,8 +1,10 @@
+%bcond_without tests # offline tests
+
Summary: Library implementing the SSH2 protocol
Summary(pl.UTF-8): Biblioteka implementująca protokół SSH2
Name: libssh2
Version: 1.11.1
-Release: 3
+Release: 4
License: BSD
Group: Libraries
Source0: https://libssh2.org/download/%{name}-%{version}.tar.gz
@@ -14,6 +16,12 @@ Patch3: CVE-2026-55200.patch
Patch4: CVE-2026-7598.patch
Patch5: CVE-2026-58050.patch
Patch6: CVE-2026-58051.patch
+Patch7: CVE-2026-66032.patch
+Patch8: CVE-2026-66033.patch
+Patch9: CVE-2026-66034.patch
+Patch10: CVE-2026-66035.patch
+Patch11: libssh2-sftp-status.patch
+Patch12: libssh2-test-result.patch
URL: https://libssh2.org/
BuildRequires: autoconf >= 2.59
BuildRequires: automake
@@ -100,8 +108,6 @@ Summary: Header files for libssh2 library
Summary(pl.UTF-8): Pliki nagłówkowe biblioteki libssh2
Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release}
-Requires: openssl-devel%{?_isa}
-Requires: zlib-devel%{?_isa}
%description devel
Header files for libssh2 library.
@@ -130,6 +136,12 @@ Biblioteka statyczna libssh2.
%patch -P4 -p1
%patch -P5 -p1
%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
+%patch -P11 -p1
+%patch -P12 -p1
%build
%{__libtoolize}
@@ -137,15 +149,24 @@ Biblioteka statyczna libssh2.
%{__autoconf}
%{__autoheader}
%{__automake}
+# Network-dependent Docker and sshd suites cannot run on isolated builders.
%configure \
+ --disable-docker-tests \
+ --disable-sshd-tests \
--disable-rpath \
--disable-silent-rules \
- --with-crypto=openssl
+ --with-crypto=openssl \
+ --with-libz
# AC_LIB_HAVE_LINKFLAGS adds unwanted -L/usr/lib to each LTLIB* - override it
%{__make} \
LTLIBSSL="-lssl -lcrypto" \
LTLIBZ="-lz"
+%if %{with tests}
+%{__make} check
+./tests/test_auth_keyboard_info_request
+%endif
+
%install
rm -rf $RPM_BUILD_ROOT
@@ -162,11 +183,11 @@ rm -rf $RPM_BUILD_ROOT
%defattr(644,root,root,755)
%doc COPYING NEWS README RELEASE-NOTES docs/{AUTHORS,BINDINGS.md,TODO}
%attr(755,root,root) %{_libdir}/libssh2.so.*.*.*
-%attr(755,root,root) %ghost %{_libdir}/libssh2.so.1
+%ghost %{_libdir}/libssh2.so.1
%files devel
%defattr(644,root,root,755)
-%attr(755,root,root) %{_libdir}/libssh2.so
+%{_libdir}/libssh2.so
%{_libdir}/libssh2.la
%{_includedir}/libssh2*.h
%{_mandir}/man3/libssh2_*.3*
diff --git a/CVE-2026-66032.patch b/CVE-2026-66032.patch
new file mode 100644
index 0000000..4e84a98
--- /dev/null
+++ b/CVE-2026-66032.patch
@@ -0,0 +1,24 @@
+From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will at panic.com>
+Date: Thu, 2 Jul 2026 11:00:23 -0700
+Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
+
+Set data to NULL after freeing it to avoid dangling pointer. fixes
+GHSA-px3w-7g75-hg7w.
+
+Credit: VladimirEliTokarev
+Forwarded: not-needed
+---
+ src/sftp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -1279,6 +1279,7 @@
+ "got HANDLE FXOK"));
+
+ LIBSSH2_FREE(session, data);
++ data = NULL;
+
+ /* silly situation, but check for a HANDLE */
+ rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,
diff --git a/CVE-2026-66033.patch b/CVE-2026-66033.patch
new file mode 100644
index 0000000..a312ac8
--- /dev/null
+++ b/CVE-2026-66033.patch
@@ -0,0 +1,40 @@
+From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit at vsz.me>
+Date: Thu, 23 Jul 2026 10:32:04 +0200
+Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in
+ `ssh2_cipher_crypt()`
+
+By applying two bounds checks to non-debug builds.
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-c4f7-cvfc-33j7
+Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797
+
+Closes #2401
+Forwarded: not-needed
+---
+ src/openssl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/src/openssl.c
++++ b/src/openssl.c
+@@ -1042,13 +1042,15 @@
+ const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
+ /* size of AT, if present */
+ const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
+- /* length to encrypt */
+- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
++ unsigned int cryptlen; /* length to encrypt */
+
+ (void)algo;
+
+- assert(blocksize <= sizeof(buf));
+- assert(cryptlen >= 0);
++ if(blocksize > sizeof(buf) ||
++ blocksize < (size_t)(aadlen + authenticationtag))
++ return 1;
++
++ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
+
+ #if LIBSSH2_AES_GCM
+ /* First block */
diff --git a/CVE-2026-66034.patch b/CVE-2026-66034.patch
new file mode 100644
index 0000000..c0d06df
--- /dev/null
+++ b/CVE-2026-66034.patch
@@ -0,0 +1,31 @@
+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit at vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+Forwarded: not-needed
+---
+ src/publickey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -988,6 +988,13 @@
+ }
+
+ if(comment_len) {
++ if(pkey->listFetch_s + comment_len >
++ pkey->listFetch_data + pkey->listFetch_data_len) {
++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++ "ListFetch data too short");
++ goto err_exit;
++ }
++
+ list[keys].num_attrs = 1;
+ list[keys].attrs =
+ LIBSSH2_ALLOC(session,
diff --git a/CVE-2026-66035.patch b/CVE-2026-66035.patch
new file mode 100644
index 0000000..9140095
--- /dev/null
+++ b/CVE-2026-66035.patch
@@ -0,0 +1,38 @@
+From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit at vsz.me>
+Date: Fri, 3 Jul 2026 18:22:55 +0200
+Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-6c79-444r-wx26
+
+Closes #2198
+Forwarded: not-needed
+---
+ src/transport.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -242,6 +242,13 @@
+ unsigned char *decrypt_buffer;
+ int blocksize = session->remote.crypt->blocksize;
+
++ if(p->total_num < mac_len + 4 + (size_t)blocksize) {
++ LIBSSH2_FREE(session, p->payload);
++ p->payload = NULL;
++ return LIBSSH2_ERROR_DECRYPT;
++ }
++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
++
+ rc = decrypt(session, p->payload + 4,
+ first_block, blocksize, FIRST_BLOCK);
+ if(rc) {
+@@ -249,7 +255,6 @@
+ }
+
+ /* we need buffer for decrypt */
+- decrypt_size = p->total_num - mac_len - 4;
+ decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
+ if(!decrypt_buffer) {
+ return LIBSSH2_ERROR_ALLOC;
diff --git a/libssh2-sftp-status.patch b/libssh2-sftp-status.patch
new file mode 100644
index 0000000..0cfc5fa
--- /dev/null
+++ b/libssh2-sftp-status.patch
@@ -0,0 +1,42 @@
+From 4ed26f5740bdd409269ed9fb48a28bf8f565b681 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will at panic.com>
+Date: Mon, 20 Oct 2025 14:04:52 -0700
+Subject: [PATCH] Fix sftp_symlink when getting SSH_FXP_STATUS response (#1731)
+
+Move advancing past packet ID before reading the FXP_STATUS response.
+---
+ src/sftp.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/src/sftp.c b/src/sftp.c
+index 70d7686daf..bb297b831a 100644
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -4006,6 +4006,13 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ "SFTP Protocol Error (type)");
+ }
+
++ /* advance past id */
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (id)");
++ }
++
+ if(packet_type == SSH_FXP_STATUS) {
+ if(_libssh2_get_u32(&buf, &tmp_u32)) {
+ LIBSSH2_FREE(session, data);
+@@ -4025,13 +4032,6 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ }
+ }
+
+- /* advance past id */
+- if(_libssh2_get_u32(&buf, &tmp_u32)) {
+- LIBSSH2_FREE(session, data);
+- return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "SFTP Protocol Error (id)");
+- }
+-
+ /* look for at least one link */
+ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {
+ LIBSSH2_FREE(session, data);
diff --git a/libssh2-test-result.patch b/libssh2-test-result.patch
new file mode 100644
index 0000000..2e38a20
--- /dev/null
+++ b/libssh2-test-result.patch
@@ -0,0 +1,13 @@
+Propagate the standalone test failure to make check.
+--- a/tests/test_simple.c
++++ b/tests/test_simple.c
+@@ -95,7 +95,7 @@
+- test_libssh2_base64_decode(session);
++ rc = test_libssh2_base64_decode(session);
+
+ libssh2_session_free(session);
+
+ libssh2_exit();
+
+- return 0;
++ return rc;
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/libssh2.git/commitdiff/2067ea54f5921db720c05b117c8ac800251b46bc
More information about the pld-cvs-commit
mailing list