mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-23 18:17:02 +00:00
Code Issues Projects Releases Wiki Activity

libssh2: fix CVE-2026-55200

Browse Source 
Backport patch to fix CVE-2026-55200.
https://nvd.nist.gov/vuln/detail/CVE-2026-55200

Upstream fix:
  https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8

Tested with ptest:
Before: PASSED: 3, FAILED: 0, SKIPPED: 0
After: PASSED: 3, FAILED: 0, SKIPPED: 0

Reviewed-by: Anders Heimer <anders.heimer@est.tech>
(From OE-Core rev: a610461f9040644bec9f1b9be23dcfff121df888)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
(cherry picked from commit 42c8c6ec3066dc47b9eeeba0247ffa927193abff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Daniel Turull
2026-06-29 08:57:31 +02:00
committed by Paul Barker
parent e146cbbc73
commit af5ab14071
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch
+36
View File
@@ -0,0 +1,36 @@
From df0b03ee5ef12f3a46fccc0fc688ebfb91702972 Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Fri, 12 Jun 2026 15:57:44 -0700
Subject: [PATCH] transport.c: Additional boundary checks for packet length
(#2052)
Add additional bounds checking on packet length to prevent OOB write.
Credit: [TristanInSec](https://github.com/TristanInSec)
CVE: CVE-2026-55200
Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8]
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
src/transport.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/transport.c b/src/transport.c
index e1120656..d147505b 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session)
total_num = 4;
p->packet_length = _libssh2_ntohu32(block);
- if(p->packet_length < 1)
+ if(p->packet_length < 1) {
return LIBSSH2_ERROR_DECRYPT;
+ }
+ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
+ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
+ }
/* total_num may include size field, however due to existing
* logic it needs to be removed after the entire packet is read
meta/recipes-support/libssh2/libssh2_1.11.1.bb
+1
View File
@@ -11,6 +11,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://run-ptest \
file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \
file://CVE-2026-7598.patch \
file://CVE-2026-55200.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"