* [wrynose] [PATCH] libssh2: fix CVE-2026-55199
@ 2026-06-29 8:19 daniel.turull
2026-07-03 15:03 ` Yoann Congal
0 siblings, 1 reply; 2+ messages in thread
From: daniel.turull @ 2026-06-29 8:19 UTC (permalink / raw)
To: openembedded-core; +Cc: yoann.congal, Daniel Turull
From: Daniel Turull <daniel.turull@ericsson.com>
Backport patch to fix CVE-2026-55199.
https://nvd.nist.gov/vuln/detail/CVE-2026-55199
Upstream fix:
https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
Tested with ptest:
Before: PASSED: 3, FAILED: 0, SKIPPED: 0
After: PASSED: 3, FAILED: 0, SKIPPED: 0
Reviewed-by: Anders Heimer <anders.heimer@est.tech
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
.../libssh2/libssh2/CVE-2026-55199.patch | 44 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch
new file mode 100644
index 0000000000..81815486ad
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch
@@ -0,0 +1,44 @@
+From b5cb1c1781ba5f275485f65855d61faaba6542b2 Mon Sep 17 00:00:00 2001
+From: TristanInSec <tristan.mtn@gmail.com>
+Date: Wed, 15 Apr 2026 14:51:08 -0400
+Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
+ handler
+
+The `SSH_MSG_EXT_INFO` handler discards the return values from
+`_libssh2_get_string()` when parsing extension name/value pairs. When
+the buffer is exhausted before all claimed extensions are parsed,
+the loop continues with no-op iterations until `nr_extensions` reaches
+zero.
+
+The `nr_extensions >= 1024` cap limits the worst case, but the loop
+should still break on parse failure for correctness and consistency
+with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
+`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
+
+Closes #1864
+
+CVE: CVE-2026-55199
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4]
+
+Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
+---
+ src/packet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index 6da14e9f..ebaddae5 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+
+ nr_extensions -= 1;
+
+- _libssh2_get_string(&buf, &name, &name_len);
+- _libssh2_get_string(&buf, &value, &value_len);
++ if(_libssh2_get_string(&buf, &name, &name_len))
++ break;
++ if(_libssh2_get_string(&buf, &value, &value_len))
++ break;
+
+ if(name && value) {
+ _libssh2_debug((session,
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index 5ffc40b8fc..2407ed34d9 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -12,6 +12,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \
file://CVE-2026-7598.patch \
file://CVE-2026-55200.patch \
+ file://CVE-2026-55199.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [wrynose] [PATCH] libssh2: fix CVE-2026-55199
2026-06-29 8:19 [wrynose] [PATCH] libssh2: fix CVE-2026-55199 daniel.turull
@ 2026-07-03 15:03 ` Yoann Congal
0 siblings, 0 replies; 2+ messages in thread
From: Yoann Congal @ 2026-07-03 15:03 UTC (permalink / raw)
To: daniel.turull, openembedded-core
On Mon Jun 29, 2026 at 10:19 AM CEST, daniel.turull wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Backport patch to fix CVE-2026-55199.
> https://nvd.nist.gov/vuln/detail/CVE-2026-55199
>
> Upstream fix:
> https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
>
> Tested with ptest:
> Before: PASSED: 3, FAILED: 0, SKIPPED: 0
> After: PASSED: 3, FAILED: 0, SKIPPED: 0
>
> Reviewed-by: Anders Heimer <anders.heimer@est.tech
Hello
The Reviewed-by: line is missing a '>' at the end.
I've fixed it.
Regards,
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
> .../libssh2/libssh2/CVE-2026-55199.patch | 44 +++++++++++++++++++
> .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 +
> 2 files changed, 45 insertions(+)
> create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch
>
> diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch
> new file mode 100644
> index 0000000000..81815486ad
> --- /dev/null
> +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch
> @@ -0,0 +1,44 @@
> +From b5cb1c1781ba5f275485f65855d61faaba6542b2 Mon Sep 17 00:00:00 2001
> +From: TristanInSec <tristan.mtn@gmail.com>
> +Date: Wed, 15 Apr 2026 14:51:08 -0400
> +Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
> + handler
> +
> +The `SSH_MSG_EXT_INFO` handler discards the return values from
> +`_libssh2_get_string()` when parsing extension name/value pairs. When
> +the buffer is exhausted before all claimed extensions are parsed,
> +the loop continues with no-op iterations until `nr_extensions` reaches
> +zero.
> +
> +The `nr_extensions >= 1024` cap limits the worst case, but the loop
> +should still break on parse failure for correctness and consistency
> +with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
> +`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
> +
> +Closes #1864
> +
> +CVE: CVE-2026-55199
> +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4]
> +
> +Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> +---
> + src/packet.c | 6 ++++--
> + 1 file changed, 4 insertions(+), 2 deletions(-)
> +
> +diff --git a/src/packet.c b/src/packet.c
> +index 6da14e9f..ebaddae5 100644
> +--- a/src/packet.c
> ++++ b/src/packet.c
> +@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
> +
> + nr_extensions -= 1;
> +
> +- _libssh2_get_string(&buf, &name, &name_len);
> +- _libssh2_get_string(&buf, &value, &value_len);
> ++ if(_libssh2_get_string(&buf, &name, &name_len))
> ++ break;
> ++ if(_libssh2_get_string(&buf, &value, &value_len))
> ++ break;
> +
> + if(name && value) {
> + _libssh2_debug((session,
> diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
> index 5ffc40b8fc..2407ed34d9 100644
> --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
> +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
> @@ -12,6 +12,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
> file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \
> file://CVE-2026-7598.patch \
> file://CVE-2026-55200.patch \
> + file://CVE-2026-55199.patch \
> "
>
> SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-03 15:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-29 8:19 [wrynose] [PATCH] libssh2: fix CVE-2026-55199 daniel.turull
2026-07-03 15:03 ` Yoann Congal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox