From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
To: openembedded-core@lists.openembedded.org
Cc: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [wrynose][PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035
Date: Mon, 3 Aug 2026 10:41:38 +0200 [thread overview]
Message-ID: <20260803084141.46902-1-jaipaul.cheernam@est.tech> (raw)
Fix three CVEs in libssh2 1.11.1 by backporting upstream fixes:
- CVE-2026-66033: potential OOB read/write with AES-GCM in ssh2_cipher_crypt()
- CVE-2026-66034: potential OOB read in libssh2_publickey_list_fetch()
- CVE-2026-66035: potential heap overflow on ETM decrypt
Backport adaptations:
- CVE-2026-66034: upstream uses ssh2_err() which is not available in
1.11.1, replaced with _libssh2_error().
- CVE-2026-66035: upstream uses SSH2_SAFEFREE() (not in 1.11.1),
replaced with LIBSSH2_FREE() + NULL reset. Also upstream renames
decrypt() to transport_decrypt(), retained original name.
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
Jaipaul Cheernam (3):
libssh2: fix CVE-2026-66033
libssh2: fix CVE-2026-66034
libssh2: fix CVE-2026-66035
.../libssh2/libssh2/CVE-2026-66033.patch | 45 +++++++++++++++
.../libssh2/libssh2/CVE-2026-66034.patch | 40 +++++++++++++
.../libssh2/libssh2/CVE-2026-66035.patch | 56 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 3 +
4 files changed, 144 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch
next reply other threads:[~2026-08-03 8:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-03 8:41 Jaipaul Cheernam [this message]
2026-08-03 8:41 ` [wrynose][PATCH 1/3] libssh2: fix CVE-2026-66033 Jaipaul Cheernam
2026-08-03 8:41 ` [wrynose][PATCH 2/3] libssh2: fix CVE-2026-66034 Jaipaul Cheernam
2026-08-03 8:41 ` [wrynose][PATCH 3/3] libssh2: fix CVE-2026-66035 Jaipaul Cheernam
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260803084141.46902-1-jaipaul.cheernam@est.tech \
--to=jaipaul.cheernam@est.tech \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox