diff mbox series

[meta-oe,scarthgap,1/3] libssh: Fix CVE-2026-0964

Message ID 20260327090921.114180-1-vanusuri@mvista.com
State New
Headers show
Series [meta-oe,scarthgap,1/3] libssh: Fix CVE-2026-0964 | expand

Commit Message

Vijay Anusuri March 27, 2026, 9:09 a.m. UTC 
Pick commits according to [1]

[1] https://security-tracker.debian.org/tracker/CVE-2026-0964
[2] https://www.libssh.org/security/advisories/CVE-2026-0964.txt

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../libssh/libssh/CVE-2026-0964.patch         | 46 +++++++++++++++++++
 .../recipes-support/libssh/libssh_0.10.6.bb   |  1 +
 2 files changed, 47 insertions(+)
 create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch
new file mode 100644
index 0000000000..947c73451f
--- /dev/null
+++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch
@@ -0,0 +1,46 @@ 
+From a5e4b12090b0c939d85af4f29280e40c5b6600aa Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Mon, 22 Dec 2025 19:16:44 +0100
+Subject: [PATCH] CVE-2026-0964 scp: Reject invalid paths received through scp
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
+(cherry picked from commit daa80818f89347b4d80b0c5b80659f9a9e55e8cc)
+
+Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=a5e4b12090b0c939d85af4f29280e40c5b6600aa]
+CVE: CVE-2026-0964
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ src/scp.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/src/scp.c b/src/scp.c
+index 103822ce..09dc1a1b 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -848,6 +848,22 @@ int ssh_scp_pull_request(ssh_scp scp)
+         size = strtoull(tmp, NULL, 10);
+         p++;
+         name = strdup(p);
++	/* Catch invalid name:
++	 * - empty ones
++	 * - containing any forward slash -- directory traversal handled
++	 *   differently
++	 * - special names "." and ".." referring to the current and parent
++	 *   directories -- they are not expected either
++	 */
++	if (name == NULL || name[0] == '\0' || strchr(name, '/') ||
++	    strcmp(name, ".") == 0 || strcmp(name, "..") == 0) {
++	    ssh_set_error(scp->session,
++			  SSH_FATAL,
++			  "Received invalid filename: %s",
++			  name == NULL ? "<NULL>" : name);
++	    SAFE_FREE(name);
++	    goto error;
++	}
+         SAFE_FREE(scp->request_name);
+         scp->request_name = name;
+         if (buffer[0] == 'C') {
+-- 
+2.43.0
+
diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
index 614b656216..d37fccf26c 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
@@ -24,6 +24,7 @@  SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable
            file://CVE-2025-8277-4.patch \
            file://CVE-2026-3731-1.patch \
            file://CVE-2026-3731-2.patch \
+           file://CVE-2026-0964.patch \
           "
 SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"