From d0331efc2395bf5f8ebc2634c6b75fb6aa319736 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Wed, 23 Sep 2026 22:40:38 +1200 Subject: [PATCH] libssh: ignore CVE-2026-59842 The vulnerability exists in GSSAPI key exchange introduced in v0.12.0[1] Also confirmed by libssh security advisory[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-59842 [1]https://gitlab.com/libssh/libssh-mirror/-/commit/88c2ea6752fab7b3da9cc4c51eaf632361a44080 [2]https://www.libssh.org/security/advisories/CVE-2026-59842.txt Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index 752bded528..49ffd29403 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -58,3 +58,4 @@ CVE_STATUS[CVE-2026-59847] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59849] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59842] = "cpe-incorrect: the current version (0.11.5) is not affected"