[wrynose,0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Message ID	20260803084141.46902-1-jaipaul.cheernam@est.tech
Headers	show Return-Path: <jaipaul.cheernam@est.tech> ip: 52.101.66.12, mailfrom: jaipaul.cheernam@est.tech) From: Jaipaul Cheernam <jaipaul.cheernam@est.tech> To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Subject: [wrynose][PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 Date: Mon, 3 Aug 2026 10:41:38 +0200 Message-ID: <20260803084141.46902-1-jaipaul.cheernam@est.tech> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0
Series	libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 \| expand [wrynose,0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 [wrynose,1/3] libssh2: fix CVE-2026-66033 [wrynose,2/3] libssh2: fix CVE-2026-66034 [wrynose,3/3] libssh2: fix CVE-2026-66035

Message ID

20260803084141.46902-1-jaipaul.cheernam@est.tech

Headers

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
To: openembedded-core@lists.openembedded.org
CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [wrynose][PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034,
 CVE-2026-66035
Date: Mon,  3 Aug 2026 10:41:38 +0200
Message-ID: <20260803084141.46902-1-jaipaul.cheernam@est.tech>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
 YMjdRHiOwnOi8GUCDzsgdKVAGpt+Yljme7zV9adMew/xuWLlkZLBiyqsUwLdaccA/i1UJaZen8UwCMZFeSvf03Z2qj1C1wRGAU5iyuoENmgyBfC6pdh+a9hSpZrjBwsyoBSet207hLHrasK4TcR7SnaDMW5sICEdW16ss10INdtrZXZVgPMyu/iA4kE8N2vh0nRegeRNcMZFi9Odzk7Q1KQqHvIBWWeqc+39EhtrnPutdt5oQrddP39v2+n+wSHSZxdgGDJVlT1TuOlU9epWPJrCkMEPud/WTYiWsNr/cGtJVr7YKf9+nlcGUJLmUo4gDzbNlotCrtIFurReAf+bhUo2pJ6vutAGFMWwJm1JFg56QPd9aoM5OnHEVWNRwcTI0mb39J4SCQ1OFRf/hx/6Z4IHgOH28EbwRpqtBFahRfYI8ynWlcIfnupP1DkvVInfgjVRuG5q5eHNX9i6TItJFlOANLDd9G4xBwO/MxrYA+0AMNnr/vGqY3jN5KBr0uZxkFCoqtBNHweX94AHh6ivlhF5e9Gw13SfgIVsqCpFBV1rqOrtDRHCnXlIWoRrJ12T7mLQ4wvRNSy5Fv80+2t4SBS9TSPxm/kHdVqs9mHPI1hiuq6hkp2To8kFi3ljJmn4uueIpT+SH/PzATTku9p/TBAdYuilAXolmAFBjP25ISDOXbW8spps+a5PyCR6pqk8xgIwp2zLln+Xf6JVA+pISI2U8an/oJnRA1ityWAIM1a9TgJlUVLMeXXnTCPdRJ1RSz/8rabsZ/Nc+ibHAjCm9KepwOmoT/YdUjR0G7MjRHHEVqnZ9w79EkwjRLVwfbj1sxb3z1aaTCRWd+gkbCgGT0WzQMN2Dq6aF7iBgAAR5FKLJm6TRHSlYL1ZEhjwCdUQKdJ/1pxZ2C24ESKFi2zjOf7fxbt/jrxs++5LdmD12iIP9YmQThVHfr9hZ0wVK21gRTO8ffP5AtRDMYozHlcoOZ/1F0QIPfOslEwjeYdO/Re+63zxGxlBYxqk5hRLfmiLK8mFVV1S9TckypIDBf7Qrqu18OQ8wYu3nMjmRdaVQQldkz6Wrb4KjGSrWbLUG6tAIagU9ZDud4BntIYAAkcM5/tHYMSiNDGkF9HUUE0h45cGdRP4ZobNwIUrsRDWF7c53W4GiU7gyvOr+jtnnOLzbktta3oQlA1fz9L5WgIq3fgTmtQynzdKH4KV9E6vx9QLd5Q6duNhGgHnAPfoAuuyJZU3nNmk4VIjqHOJAXJjxOvC/vRyTol9J0w/RquAAeaY+U15vWSHE+uCgp9+uy9NoGzBf7mGK0xBTGloRQ0kTQ5gU4w1qexTQBK+JYSAi7xRD99kRa6FOVGOE59E257lyNyJp46emTBUB7Wc8/GgDTDCgcED2om0fbpJNS64AhBwl1gcmzEYrQ+HNY2J0APvtiERVK7bGW0iJQyQ8R6NLK7kKnNundiXwcqZDXWVwp/jxCwaXaRpHWriJ5vY7yYljjAIFa9OJLsUaR2XGj2TrFeCtxK9rHHxS8kHGRs6L1vXLTCqdGVRClX0v3UoOYM7g8x5gtKC4W9Cu/zjrmj7ILsKlTDsVeAEZIwccAK5LnommTXbjXI2XkccRly9SlmS3yMq68bUaiSeb5Aq2k0MJnxP8gAcZvaODgc2dTq6Y3yhCw546OYsqm50guxEgK/2b3bQrTLPWY4jfzVVstRc+hFclkhHGU1xT+6wY9XJypdg0FPEzWFoVJ5Xl7vMv+NrMxlQOjAENHnMhggNYWE0FpQ=
X-OriginatorOrg: est.tech
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 9de238a4-ff66-481b-de99-08def13b0e4d
X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 08:41:47.9546
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 0xwt3WcnFlDRfXR42xqr+iq9RZQlvrkrcItcgWmzDwjPjAHhGWS/cAj5/Vx6TOJzfA7acpxd/EhlgXkIPx/yaeSiXCOo4SZWtkSkAErDTbU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4P189MB2215
List-Id: <openembedded-core.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com
 [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-core@lists.openembedded.org>; Mon, 03 Aug 2026 08:41:58 -0000
X-Groupsio-URL: 
 https://lists.openembedded.org/g/openembedded-core/message/242622

Series

libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 | expand

Message

Jaipaul Cheernam Aug. 3, 2026, 8:41 a.m. UTC

Fix three CVEs in libssh2 1.11.1 by backporting upstream fixes:

- CVE-2026-66033: potential OOB read/write with AES-GCM in ssh2_cipher_crypt()
- CVE-2026-66034: potential OOB read in libssh2_publickey_list_fetch()
- CVE-2026-66035: potential heap overflow on ETM decrypt

Backport adaptations:
- CVE-2026-66034: upstream uses ssh2_err() which is not available in
  1.11.1, replaced with _libssh2_error().
- CVE-2026-66035: upstream uses SSH2_SAFEFREE() (not in 1.11.1),
  replaced with LIBSSH2_FREE() + NULL reset. Also upstream renames
  decrypt() to transport_decrypt(), retained original name.

libssh2 ptest results (qemux86-64):
  before: PASSED: 1 FAILED: 0 SKIPPED: 0
  after:  PASSED: 1 FAILED: 0 SKIPPED: 0

Jaipaul Cheernam (3):
  libssh2: fix CVE-2026-66033
  libssh2: fix CVE-2026-66034
  libssh2: fix CVE-2026-66035

 .../libssh2/libssh2/CVE-2026-66033.patch      | 45 +++++++++++++++
 .../libssh2/libssh2/CVE-2026-66034.patch      | 40 +++++++++++++
 .../libssh2/libssh2/CVE-2026-66035.patch      | 56 +++++++++++++++++++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |  3 +
 4 files changed, 144 insertions(+)
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch