[0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Message ID	20260803082242.44009-1-jaipaul.cheernam@est.tech
Headers	show Return-Path: <jaipaul.cheernam@est.tech> ip: 52.101.66.49, mailfrom: jaipaul.cheernam@est.tech) From: Jaipaul Cheernam <jaipaul.cheernam@est.tech> To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Subject: [PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 Date: Mon, 3 Aug 2026 10:22:39 +0200 Message-ID: <20260803082242.44009-1-jaipaul.cheernam@est.tech> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0
Series	libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 \| expand [0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 [1/3] libssh2: fix CVE-2026-66033 [2/3] libssh2: fix CVE-2026-66034 [3/3] libssh2: fix CVE-2026-66035

Message ID

20260803082242.44009-1-jaipaul.cheernam@est.tech

Headers

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
To: openembedded-core@lists.openembedded.org
CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034,
 CVE-2026-66035
Date: Mon,  3 Aug 2026 10:22:39 +0200
Message-ID: <20260803082242.44009-1-jaipaul.cheernam@est.tech>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
 WR/KZu0rAkoaH5V/a78AOKQCIyZlh3rdQEljXVbxQK9NbQ7h7L5WpxEcLkdl044y/BoPl4Lj/yDOmc9d9Uf8XKWkSff9qRSFNUz+fIY7dOO7ZhyU1DbR/cjmKOkqBBzXFgQyibsDtHDSUQgtjmRgGrrOpxQZRmJb12LLyS+M2fttqwGA16TlB0u85s2G2wpPjDYrIoIc+STHTrO9X7dqq70QZj+2dlfWF9h8+MfPjMGhsfTWfx5Yz+/vpxU2EckGNH7cROuPgif1jxwOTGLEtqbpgNnhInUGUwyjTpKuAX61pmQY+KmBc0Y1ZooPJcBiRuKzocdLAPEY6ElbgHAgLJiLoRBATU9LbCpAjrHuu0LXgnn/OiCFDy1NAkhc6CxxsF+iRgXnho7I5TBH4592OrVGeHSAybDXJxiEkVDir/RrhdQ2xXw8SAWUm8GV+q4zRoasdbVdW18bpLMfhoMv1Ralc2Eu/GL0CLc7wfFLwTxxpB75b7jlDsVoi656AgKXT+M6eoFq3HuwP6IIaJYSIZ+7kuyQQo5A9MD5H8w37PRqb9jQyDIZMHih+uHlaYL9xa8NXzMSPrW+g/4IphU5AhoWRl3QxnPIXjN+/eYMKLbvnRiTKvKmkPWh5aPDL2mreIOHmP//4EE68rvWenSLUwRytRRmgGmSNREoEewxn6KTWoTaQ7qagLlDv1o/rJR4MjZa2FnsdzN98l0rGnM5r9dmD8G6RwhjAFoCPQpe6IttLvT99wGiWIRQcqX85vnK1BPxvmflC8KRgTI5+w7CbeQA3zwBdHNexRRJem5AFWjGpqJaKa9YMo4ccbbBva9avHCzQQPcK64yeEeFDSi/VG4mENNhSOg8WROhJ71nA4zfTdVek8uSFks56Xt9cq5UO+7p/jPKZ3R9oopvQ7Mx+FVpz9xB8CEsjb45WSgt4TPR482AHyI1bSR37T0mBWwxxH/aqa0aL/NQO/ImIz3M35LpTh1ik9k4tWh2msEmV9/6KMBrZ7F3Nukcv6rvaGkAHNBbhNX6GP52hVHRTYa6V7/9zwuwnqnbFm3mtfMAwTRZ44QM92eBshk+cm8/eMf/NT4v26yZBNGA1fDTSItvypoLmIKe7oXfA+7GkCXGgNfexkC1bwvwsrh3gtOCdPS6yIaFb2u8t/Nd8YADaU7QyV0BIG9WO31s/0/YAg3S3SMAFnzmgSAMZ3/dWjJoBThswPILGSfyQ2dElZTsWXPTNUrftX8Qgs548pmZCul+Cqr6iKUCLs+0P7KfmuPqbTIKzNVpg8AFcm0TkWFyMObtPjdAtHF9zv/r/mJM8jkfwm98QEYpWHoEeO6y0W+iaxDu+sXM+nznjm25yZy2zMUwbUt2xHd0quqbIDRRMRpVMKAS47OG28bCaOLYaJB//h9rJIVYMQ1bay/yZtk5pBDkt+U5UW2lYMF8qDmf8jbFtqUS1NCyhioNprzcCeUvpirhCkuWj70f+vcUgM0yJ0ceLljQ2csqNJ0fVUfqc7uCdd8bFkjH1P9+4KaNiVuZK5ie/96DQOB6XAbODjjHLuyy7jU4b9t/FPoMTZtYIf5Q7pM3HOuRsGuCjjEs50A9izk1p+TVyEp9Ai/xZygxd/2TFeHiqjWDlmw9m/dByXH7nByDakJG3sNj+LqgCtxNQ40X0YKK3FOlBzz7a7f+Gnwsor5knFGYbS4wgtATCF6sBEfZK+Zn09DkMfBAUfrxvaZ4Iyjud+Jg2Oi3vgTphwbGBg==
X-OriginatorOrg: est.tech
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 74a170a7-3c00-49e7-b836-08def13868ab
X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 08:22:51.0774
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 +ZWKdqzBeUKliQhkKnBucK7TBvkYEHXb5d8IDUsGHjFuSs8X9qkfCK37sqp6f4ZOs5O5qCzQcfYzuL7KLcm8/Ey10pwOzP1Z0Jnjbm5IZDE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB3098
List-Id: <openembedded-core.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com
 [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-core@lists.openembedded.org>; Mon, 03 Aug 2026 08:22:58 -0000
X-Groupsio-URL: 
 https://lists.openembedded.org/g/openembedded-core/message/242617

Series

libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 | expand

Message

Jaipaul Cheernam Aug. 3, 2026, 8:22 a.m. UTC

Fix three CVEs in libssh2 1.11.1 by backporting upstream fixes:

- CVE-2026-66033: potential OOB read/write with AES-GCM in ssh2_cipher_crypt()
- CVE-2026-66034: potential OOB read in libssh2_publickey_list_fetch()
- CVE-2026-66035: potential heap overflow on ETM decrypt

Backport adaptations:
- CVE-2026-66034: upstream uses ssh2_err() which is not available in
  1.11.1, replaced with _libssh2_error().
- CVE-2026-66035: upstream uses SSH2_SAFEFREE() (not in 1.11.1),
  replaced with LIBSSH2_FREE() + NULL reset. Also upstream renames
  decrypt() to transport_decrypt(), retained original name.

libssh2 ptest results (qemux86-64):
  before: PASSED: 1 FAILED: 0 SKIPPED: 0
  after:  PASSED: 1 FAILED: 0 SKIPPED: 0

Jaipaul Cheernam (3):
  libssh2: fix CVE-2026-66033
  libssh2: fix CVE-2026-66034
  libssh2: fix CVE-2026-66035

 .../libssh2/libssh2/CVE-2026-66033.patch      | 45 +++++++++++++++
 .../libssh2/libssh2/CVE-2026-66034.patch      | 40 +++++++++++++
 .../libssh2/libssh2/CVE-2026-66035.patch      | 56 +++++++++++++++++++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |  3 +
 4 files changed, 144 insertions(+)
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch