[wrynose,v2,0/4] libssh2: fix CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Message ID	20260804131113.3588-1-jaipaul.cheernam@est.tech
Headers	show Return-Path: <jaipaul.cheernam@est.tech> ip: 52.101.69.36, mailfrom: jaipaul.cheernam@est.tech) From: Jaipaul Cheernam <jaipaul.cheernam@est.tech> To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Subject: [wrynose][PATCH v2 0/4] libssh2: fix CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 Date: Tue, 4 Aug 2026 15:11:09 +0200 Message-ID: <20260804131113.3588-1-jaipaul.cheernam@est.tech> In-Reply-To: <20260803084141.46902-1-jaipaul.cheernam@est.tech> References: <20260803084141.46902-1-jaipaul.cheernam@est.tech> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0
Series	libssh2: fix CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 \| expand [wrynose,v2,0/4] libssh2: fix CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 [wrynose,v2,1/4] libssh2: fix CVE-2026-66032 [wrynose,v2,2/4] libssh2: fix CVE-2026-66033 [wrynose,v2,3/4] libssh2: fix CVE-2026-66034 [wrynose,v2,4/4] libssh2: fix CVE-2026-66035

Message ID

20260804131113.3588-1-jaipaul.cheernam@est.tech

Headers

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
To: openembedded-core@lists.openembedded.org
CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [wrynose][PATCH v2 0/4] libssh2: fix CVE-2026-66032, CVE-2026-66033,
 CVE-2026-66034, CVE-2026-66035
Date: Tue,  4 Aug 2026 15:11:09 +0200
Message-ID: <20260804131113.3588-1-jaipaul.cheernam@est.tech>
In-Reply-To: <20260803084141.46902-1-jaipaul.cheernam@est.tech>
References: <20260803084141.46902-1-jaipaul.cheernam@est.tech>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
 5c71dG7eOsaqY+0eHzTEbLi8kef2GfvxvNJoBnXdpUUqXRFNfso2pbWeuUtGhC69x+NLLuV/afiswtX1m4LU0FCMRq6RUDLbd+VMa7sACM+aBncZQe0zRFzMYhAYdUf0VONwqJ3w1qj0MDqZIujAdR3JxaLT5Dn9NnMZGXXZk0na2/ERSxxoqRFffPHxztcR9qjdUNXp+YG/NnV4DTfMC1ESGGTdmL88BcNFn4At19AKgbdZRmlOxXVrZAk2t5O78ngZqRUZ7lXDZYsFt9UMUkcQ54ypJ82X76vrhYoMbeIkFUMX2Are2uaHFSy3LsIvbtuGsJMH/kQDpt4pJgU3d0zqE44dmWg0QUK0w3BeBFQMicBDlO7r4HwI3tihpySQ4Zoqa8fNVBz56hvdbuQ/DYhzPu3q2N4snhPGKpog3az2iMUSYo4a7sqqQs/SCbQXHXJ2NheHBP3wisDTYc+WjAf+41yOG3iiDULpJJk5HQQwwGIEPl3CkheIH5Zl7iOfP8UUThMYZ0qqSKEJc3XDmf6UJ6kBgMGQ8jbqq6xYP5FsuR2F826+3LsshFn8EB3WAWDzdlMA1eXHqC4sOzsheLPIA6aDwDtr1CjC3gckFOX7MFfdjCeXGpZmtXeQCDCZqGjaAs7x+JcoonZdtPMKoLGkgf5VSjDadvH8lAE7sTq7FzhIT1QDnV6JI/6T32Mmugs5+1zVTD+mtSpCebkA5kzatEiFfQjzU8XuBGHMmCdr2UbbYoWgrRhV2L9eVvrCUn8c3VxLhtaa93utIFYdcjcc3yop3oys05lA0YAKfCrQkWUiLgnhFn5PSGSWVhgPaH596JrpQ+LzqJAfGgz0Em8TQ4TxHr6zA1Xf7ZvgjnwzbhgrsXuTtxIPWne1Tk4WLPqw4ZXjLVXy5PRSNRqNV7Yn0HZJnWLE5FsVe1IPZ3ZzdugC9Vdejmb95e5eeBM4pz0t+gHs2gxP/4sKBJxraB482SExLEkW4DBxCICXMVWftTmUHhqX993I/qWfXUuGNk8XXWPCPiS6hTb1vSgQAOcCfL9emVIqKQbuIbSnwK37dw05Nddmn4Z1zAwSHpbAxes3Dn6Lw3jnGaJYhJRHvSsm/Rth8fNQ1Bis4DAQng8o33MYiLN4bJQfIGgSlwY1oC3nrvV/eX+SZCECszAAoAAR99hM/eE7a+OMicZT7ejWF/Vqi1NxJsid/NAHT2opNXQN/xGl/r0OqWYqInkC3YWZO6P7iSwU55U/J8iY/YLEaeQd1m6fGOVmw+4mTAAKJsre97Yh2RN+dL5yjlziUPYiux+BaErBpws9RELE+B1Hv0uv4hCaOTbIYSnPC9249dSMvvL8Ac6cEq5jug3RdNk3q14fcwvZYUQ+jpZrEryBo52hm8osD5npfgyWUzyfR4fCWY2uPrAHxWS0iRes5c8DdLlvMHex0+dTpseakFFgjUI5TT6GS1Z6GMkhEjay+xPyIj57TDSfWxorW4SR5o0pPqgGiHrsbAL+VDiXQ8M9gm/T4PZK26cRXS2oc5tmApJR3V/a9zf/b4HJg8ls/0YqZUuniuKkvlvvnGKGqUR6zGhuHZAb3I5ObYZzHADY2kdnQ/NVKYQcwDQ67Jds2Oj2/Jv5WThc5VhUlJzTXYih0iuRsUCT1kRVZrU2oPMbnAtf3Z8rvNrgoguQYAqWTvqDqWZljaWZzVHISS69mPv2PY5C63xJ9k5vYSelSwEV84RQ+txiyR6e0pKnyyNyQY9UolHea/tENiSPp8CsJQk=
X-OriginatorOrg: est.tech
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 8317a74e-b645-4212-8d75-08def229dd76
X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2026 13:11:15.7378
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 gcBI3v5WKSeCvvXEyvXwa1m8M7Ed0euJGNsDnGUZaOhkOCMGJixa5GM7RBh0e/Nx1kFmo/lTbQOoDzWvlCvnU/Em6s26WFwyIfVja2UiJeA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P189MB0858
List-Id: <openembedded-core.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com
 [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-core@lists.openembedded.org>; Tue, 04 Aug 2026 13:11:25 -0000
X-Groupsio-URL: 
 https://lists.openembedded.org/g/openembedded-core/message/242758

Series

libssh2: fix CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 | expand

Message

Jaipaul Cheernam Aug. 4, 2026, 1:11 p.m. UTC

Fix four CVEs in libssh2 1.11.1 by backporting upstream fixes:

- CVE-2026-66032: dangling pointer in sftp_open after free
- CVE-2026-66033: potential OOB read/write with AES-GCM in ssh2_cipher_crypt()
- CVE-2026-66034: potential OOB read in libssh2_publickey_list_fetch()
- CVE-2026-66035: potential heap overflow on ETM decrypt

Backport adaptations:
- CVE-2026-66032: upstream uses SSH2_FREE() renamed from LIBSSH2_FREE()
  in newer libssh2. Context adjusted for 1.11.1.
- CVE-2026-66034: upstream uses ssh2_err() which is not available in
  1.11.1, replaced with _libssh2_error().
- CVE-2026-66035: upstream uses SSH2_SAFEFREE() (not in 1.11.1),
  replaced with LIBSSH2_FREE() + NULL reset. Also upstream renames
  decrypt() to transport_decrypt(), retained original name.

Changes since v1:
- Added CVE-2026-66032 fix

libssh2 ptest results (qemux86-64):
  before: PASSED: 1 FAILED: 0 SKIPPED: 0
  after:  PASSED: 1 FAILED: 0 SKIPPED: 0

Jaipaul Cheernam (4):
  libssh2: fix CVE-2026-66032
  libssh2: fix CVE-2026-66033
  libssh2: fix CVE-2026-66034
  libssh2: fix CVE-2026-66035

 .../libssh2/libssh2/CVE-2026-66032.patch      | 36 ++++++++++++
 .../libssh2/libssh2/CVE-2026-66033.patch      | 45 +++++++++++++++
 .../libssh2/libssh2/CVE-2026-66034.patch      | 40 +++++++++++++
 .../libssh2/libssh2/CVE-2026-66035.patch      | 56 +++++++++++++++++++
 .../recipes-support/libssh2/libssh2_1.11.1.bb |  4 ++
 5 files changed, 181 insertions(+)
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
 create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch