mbox series

[OE-core,scarthgap,v2,0/5] libssh: Fix multiple CVEs

Message ID 20260901085357.1254306-1-hthakar@cisco.com
Headers show
Series libssh: Fix multiple CVEs | expand

Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Sept. 1, 2026, 8:53 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Backport five upstream libssh security fixes to the 0.10.6 recipe on
 scarthgap:

 - CVE-2026-59843
 - CVE-2026-59844
 - CVE-2026-59846
 - CVE-2026-59848
 - CVE-2026-59850

Carry these as focused backports instead of upgrading libssh because
newer releases include API and functional changes outside the security
scope.

CVE-2026-15370 and CVE-2026-59849 affect libssh >= 0.11.0.
CVE-2026-59842 and CVE-2026-59851 affect only libssh 0.12.0 and rely on
code or features absent from 0.10.6. NVD correction requests have been
submitted for these inaccurate affected-version entries; therefore, no
CVE_STATUS entries are added.

The individual commits retain the upstream fix provenance and advisory
references for each CVE.

Testing:
- Applied all five patches to libssh 0.10.6 in series order without
  conflicts or fuzz.
- Package build completed successfully.
- Ptest completed successfully. 

Hetvi Thakar (5):
  libssh: Fix CVE-2026-59843
  libssh: Fix CVE-2026-59844
  libssh: Fix CVE-2026-59846
  libssh: Fix CVE-2026-59848
  libssh: Fix CVE-2026-59850

 .../libssh/libssh/CVE-2026-59843.patch        |  84 +++
 .../libssh/libssh/CVE-2026-59844.patch        |  52 ++
 .../libssh/libssh/CVE-2026-59846.patch        |  87 +++
 .../libssh/CVE-2026-59848-regression.patch    |  45 ++
 .../libssh/libssh/CVE-2026-59848.patch        | 684 ++++++++++++++++++
 .../libssh/libssh/CVE-2026-59850.patch        |  40 +
 .../recipes-support/libssh/libssh_0.10.6.bb   |   6 +
 7 files changed, 998 insertions(+)
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59843.patch
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59846.patch
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59848-regression.patch
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59848.patch
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch