diff mbox series

[meta-oe,scarthgap,2/2] libssh: set status for CVE-2026-59842

Message ID 20260813055042.91413-2-hprajapati@mvista.com
State New
Headers show
Series [meta-oe,scarthgap,1/2] libssh: set status for CVE-2026-15370 | expand

Commit Message

Hitendra Prajapati Aug. 13, 2026, 5:50 a.m. UTC 
Analysis:
  - CVE-2026-59842 affects information disclosure via short GSSAPI Curve25519 public key.
  - This vulnerable code is not present in the current libssh 0.10.6.
  - Hence ignoring the CVE for this version.

Reference:
1. https://www.cve.org/CVERecord?id=CVE-2026-59842
2. https://www.libssh.org/security/advisories/CVE-2026-59842.txt
3. https://security-tracker.debian.org/tracker/CVE-2026-59842

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 meta-oe/recipes-support/libssh/libssh_0.10.6.bb | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
index 13e01ff9fc..63854ef5fd 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
@@ -72,3 +72,4 @@  BBCLASSEXTEND = "native nativesdk"
 CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: only affects Windows due to loading configuration from C:\etc"
 #Reference: https://www.libssh.org/security/advisories/CVE-2026-15370.txt
 CVE_STATUS[CVE-2026-15370] = "fixed-version: vulnerable SFTP server longname construction handling was introduced in 0.11.0 and is not present in 0.10.6"
+CVE_STATUS[CVE-2026-59842] = "fixed-version: vulnerable information disclosure via short GSSAPI Curve25519 public key in 0.12.0 and is not present in 0.10.6"