From b8bc579daa8e428e5ef6979ba295a0f1af6fda62 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Thu, 13 Aug 2026 11:20:41 +0530 Subject: [PATCH] libssh: set status for CVE-2026-15370 Analysis: - CVE-2026-15370 affects stack buffer overflow in SFTP server longname construction. - This vulnerable code is not present in the current libssh 0.10.6. - Hence ignoring the CVE for this version. Reference: https://www.cve.org/CVERecord?id=CVE-2026-15370 https://www.libssh.org/security/advisories/CVE-2026-15370.txt Signed-off-by: Hitendra Prajapati Signed-off-by: Anuj Mittal --- meta-oe/recipes-support/libssh/libssh_0.10.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 1e1b5fb0a5..13e01ff9fc 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -70,3 +70,5 @@ do_install_ptest () { BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: only affects Windows due to loading configuration from C:\etc" +#Reference: https://www.libssh.org/security/advisories/CVE-2026-15370.txt +CVE_STATUS[CVE-2026-15370] = "fixed-version: vulnerable SFTP server longname construction handling was introduced in 0.11.0 and is not present in 0.10.6"