[scarthgap,0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Message ID	20260804122255.3053-1-jaipaul.cheernam@est.tech
Headers	show Return-Path: <jaipaul.cheernam@est.tech> ip: 40.107.162.22, mailfrom: jaipaul.cheernam@est.tech) From: Jaipaul Cheernam <jaipaul.cheernam@est.tech> To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Subject: [scarthgap][PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 Date: Tue, 4 Aug 2026 14:22:52 +0200 Message-ID: <20260804122255.3053-1-jaipaul.cheernam@est.tech> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0
Series	libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 \| expand [scarthgap,0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 [scarthgap,1/3] libssh2: fix CVE-2026-66033 [scarthgap,2/3] libssh2: fix CVE-2026-66034 [scarthgap,3/3] libssh2: fix CVE-2026-66035

Message ID

20260804122255.3053-1-jaipaul.cheernam@est.tech

Headers

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
To: openembedded-core@lists.openembedded.org
CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [scarthgap][PATCH 0/3] libssh2: fix CVE-2026-66033, CVE-2026-66034,
 CVE-2026-66035
Date: Tue,  4 Aug 2026 14:22:52 +0200
Message-ID: <20260804122255.3053-1-jaipaul.cheernam@est.tech>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
 2CnheEVVB6L2mnHj8WiFe+fBvbr2YHNL7RSAfQHrZYdlGGZvdASnBMdWEKyaQT297TpYz71inUvJ31sAyxhcwGFm3nStgXqJPdgHBvZuY2z3qSufQRkjHk+EgePodJGu5w8syO/zS1eVutuCmG8ISc3Yl7YaKZCd00xd2uRNz46uhJTZVsafhc1+m8bOOB5/hcozsC+GYWYjCwwPMdoTXPpiJKJrNYeGG9ViBd7KVP2qJOsb5nf0he8J129ikr+PoRRyFS2fYtB8DdXOIwZwl7O9VgP3Mkss9NhP7uPLVmnssHSVuj2yZXTwybfObK+NOD5KO5PE246sGIUnFwa394PFAuMNSmNFCW3ALQrL9IogZB6eJNP2jvlf2wWoTrADKCkxxh7e/yrkfIPv6Q6TlKP26Xi269tbr3jyVHvBOKCl/3yOO7NayS+G6rn4qX9afRb8DVb1gAW77LPggtJPltcLjL00VU/hDcqCvzHS6u689bhPDLh5PhYc7nj1nAZ1nqjDwEqnFSsHEMlE1Jv2rZFMNsvLXpKfLOADZZtg6ry6tXufhLZB9aDuITCnkl6ywOPKsZGEDhAPX/VoR4jtL30HIU5KC1jnHQKGZ98EoeRn9ME84bF1FYdf/3CQwHsedXkjKL2OSCZ6+26HxGImqGRz48xEhzMZ8EkM2odFUa2Sdia9kT6GdeDrCzK6/Xt5pRgzK5lcshafXft4OI1qOQSvNVoEP6s4+kd1z9IPbtHPUcOKJqYnm68ByfbPYdxZkIyhBaTXqQn7jj2GN/NeMYKIxPoUtIrcsMtIq59jJqAEy2566UDsVj4TvIbzs/SDPpfRC7dzwVF4YdRJurWvYGyWrSP8Jc8OyxRCqGwOoAyYvzzyPD4X2QO+CwJQyEEY3tGTAWOg/DxClbFMQY+Eg3DEJyobk9r6qbopn05AGHCTXPYUNNMhSf1MOVZfqo+kD9/GZ1UMG1KZLx3x1ExqRsSPRePGD1ImVrnJGxHQfyFJy6ybljQy5ugNo/wBWidvXkrFdh9QtGBA8nJtt1wDXL3+rIkK1MMHWwF/twT/LDSxQXusByrrVeQsFc+R7ueoHCoupaemG4fAnqv9e2kcbvgW3K7Hgwe/uiuOyj0oQKm0Tof1Zt7WRO3eTxCLWdBk7PHLUyDosWRugVeLq1oZTlOefDFveklzusMA+RgK2MDVa5XzRUBCp2zH/2iU4h7sjKq+DPBOa3nFBLeW5B4J0yZbi9DJa8OWs1bjiTvK/T+28prUM7KRjcIQhHBk/fYX7V/xHc0qLpDMEqZkB1mnjMSEXlKMPM3xsrgzc5lsIGvt8ZuLl2s30bDr4dO5Ao0TJ90DGuQDL5hGq1hVtas2FLQ1ySKi6QwHa6frnNbH5z9Hl4UJP1PT0XJUSK+06QdiIYYR6SJSG9oWf9KiPxk3zp0XWUlPCV0djSwTyXw8H2ImlE0nRa9d+akW80B1GklqQ1vqgYg3QDp0EkH6ZwSRN/5hMpK3X0GONwNJQveyvdfyTf4EpV9ElfY1DbqEfQYv7iJ55kxCVaDHWXybHgvPmc1VeeB7WBD7lfeDNg1M/mp2lGTSVSykaDMyqzX1E4fv+Xn8F05B6H5UIy3qO5YBoyT3DpNqB4V/pi/7LzNLs+Dw9rQQmUEPFjV2yVFfbDGC1KplCwYmft7kF+VA+RPVFFKnPa9/+rdJlFHeuxPibzpRW/mYeEFIor1MGeLMSpx9ka2Nil+UQtirF2RUpzzo+udjn9KWix/7dWQbXQBS1/4=
X-OriginatorOrg: est.tech
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 9362341a-0d22-43b3-c4cd-08def2232109
X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2026 12:23:02.7276
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 ngFMTRdP9zQI1Pe2ACEvK5xEMANlgag9wRN/xSZ4HZABiGAdlRqnjDlb12Nohnj3CyYGzC3rctR97lRulr4zkyHHPz8pbpD5yUvfhEzfaNM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8P189MB0779
List-Id: <openembedded-core.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com
 [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-core@lists.openembedded.org>; Tue, 04 Aug 2026 12:23:14 -0000
X-Groupsio-URL: 
 https://lists.openembedded.org/g/openembedded-core/message/242735

Series

libssh2: fix CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 | expand

Message

Jaipaul Cheernam Aug. 4, 2026, 12:22 p.m. UTC

Fix three CVEs in libssh2 1.11.1 by backporting upstream fixes:

- CVE-2026-66033: potential OOB read/write with AES-GCM in ssh2_cipher_crypt()
- CVE-2026-66034: potential OOB read in libssh2_publickey_list_fetch()
- CVE-2026-66035: potential heap overflow on ETM decrypt

Backport adaptations:
- CVE-2026-66034: upstream uses ssh2_err() which is not available in
  1.11.1, replaced with _libssh2_error().
- CVE-2026-66035: upstream uses SSH2_SAFEFREE() (not in 1.11.1),
  replaced with LIBSSH2_FREE() + NULL reset. Also upstream renames
  decrypt() to transport_decrypt(), retained original name.

libssh2 ptest results (qemux86-64):
  before: PASSED: 1 FAILED: 0 SKIPPED: 0
  after:  PASSED: 1 FAILED: 0 SKIPPED: 0

Jaipaul Cheernam (3):
  libssh2: fix CVE-2026-66033
  libssh2: fix CVE-2026-66034
  libssh2: fix CVE-2026-66035

 .../libssh2/libssh2/CVE-2026-66033.patch      | 45 ++++++++++++++
 .../libssh2/libssh2/CVE-2026-66034.patch      | 40 ++++++++++++
 .../libssh2/libssh2/CVE-2026-66035.patch      | 62 +++++++++++++++++++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |  3 +
 4 files changed, 150 insertions(+)
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch