mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 00:30:20 +00:00
Code Issues Projects Releases Wiki Activity

libssh: Fix CVE-2026-59844

Browse Source 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59844 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9
[2] https://www.libssh.org/security/advisories/CVE-2026-59844.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-09-02 10:39:24 +05:30
committed by Anuj Mittal
parent f6b642b915
commit 0428dc2fe2
2 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch
+52
View File
@@ -0,0 +1,52 @@
From ef7cd6d4aef6d18ca8bf15cb0398b630284f46f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
Date: Fri, 6 Mar 2026 18:05:29 +0100
Subject: [PATCH] CVE-2026-59844 sftpserver: cap accepted values of len in
SSH_FXP_READ
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The client-provided length is directly used in
a malloc in process_read(), so not restricting it
leads to allocations bounded only by UINT32_MAX.
The new cap is the same as the one currently used
by OpenSSH.
Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
CVE: CVE-2026-59844
Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9]
Backport Changes:
- Replace the upstream goto error path with equivalent direct message cleanup
and return because libssh 0.10.6 does not have the refactored
sftp_make_client_message() error label.
(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627)
(cherry picked from commit e31f06e5380be4e714d5ad6965981fbf30738da9)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
src/sftpserver.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/sftpserver.c b/src/sftpserver.c
index 528ef6f9..77290068 100644
--- a/src/sftpserver.c
+++ b/src/sftpserver.c
@@ -105,6 +105,13 @@ sftp_client_message sftp_get_client_message(sftp_session sftp) {
sftp_client_message_free(msg);
return NULL;
}
+ if (msg->len > MAX_PACKET_LEN - 1024) {
+ ssh_set_error(sftp->session, SSH_FATAL,
+ "Too large SSH_FXP_READ length: %" PRIu32,
+ msg->len);
+ sftp_client_message_free(msg);
+ return NULL;
+ }
break;
case SSH_FXP_WRITE:
rc = ssh_buffer_unpack(payload,
meta-oe/recipes-support/libssh/libssh_0.10.6.bb
+1
View File
@@ -36,6 +36,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable
file://CVE-2026-59847-01.patch \
file://CVE-2026-59847-02.patch \
file://CVE-2026-59843.patch \
file://CVE-2026-59844.patch \
"
SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"