mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-24 11:40:17 +00:00
Code Issues Projects Releases Wiki Activity

libssh: Fix CVE-2026-59850

Browse Source 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59850 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2
[2] https://www.libssh.org/security/advisories/CVE-2026-59850.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-09-02 10:39:59 +05:30
committed by Anuj Mittal
parent 6e303a0123
commit b5874ea07d
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch
+40
View File
@@ -0,0 +1,40 @@
From a207ee3b4244c0e5da902245f8b81f3617b416f3 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Wed, 1 Jul 2026 16:43:08 +0200
Subject: [PATCH] CVE-2026-59850 channels: Avoid processing DATA packets on
closed channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
CVE: CVE-2026-59850
Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2]
(cherry picked from commit a8a3fa352bb5213e08a35e4494c6e44360e2e38a)
(cherry picked from commit 6edfb52b3b364577d2db0334c0514a977efceed2)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
src/channels.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/channels.c b/src/channels.c
index 3afdcf11..1543c792 100644
--- a/src/channels.c
+++ b/src/channels.c
@@ -575,6 +575,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){
channel->local_window,
channel->remote_window);
+ if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) {
+ SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel");
+ ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel");
+ SSH_STRING_FREE(str);
+ return SSH_PACKET_USED;
+ }
+
/* What shall we do in this case? Let's accept it anyway */
if (len > channel->local_window) {
SSH_LOG(SSH_LOG_RARE,
meta-oe/recipes-support/libssh/libssh_0.10.6.bb
+1
View File
@@ -40,6 +40,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable
file://CVE-2026-59846.patch \
file://CVE-2026-59848.patch \
file://CVE-2026-59848-regression.patch \
file://CVE-2026-59850.patch \
"
SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"