diff mbox series

[meta-oe,wrynose,24/42] libssh: ignore CVE-2026-59842

Message ID	20260923104056.457360-24-ankur.tyagi85@gmail.com
State	New
Headers	show Return-Path: <ankur.tyagi85@gmail.com> ip: 209.85.210.177, mailfrom: ankur.tyagi85@gmail.com) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi <ankur.tyagi85@gmail.com> Subject: [oe][meta-oe][wrynose][PATCH 24/42] libssh: ignore CVE-2026-59842 Date: Wed, 23 Sep 2026 22:40:38 +1200 Message-ID: <20260923104056.457360-24-ankur.tyagi85@gmail.com> In-Reply-To: <20260923104056.457360-1-ankur.tyagi85@gmail.com> References: <20260923104056.457360-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-oe,wrynose,1/42] c-ares: mark CVEs fixed \| expand [meta-oe,wrynose,1/42] c-ares: mark CVEs fixed [meta-oe,wrynose,2/42] cjose: mark CVE-2026-53938 and CVE-2026-53939 fixed [meta-oe,wrynose,3/42] cjson: patch CVE-2026-87933 [meta-oe,wrynose,4/42] colord: ignore CVE-2026-85062 [meta-oe,wrynose,5/42] flatcc: patch CVE-2026-90786 [meta-oe,wrynose,6/42] flatcc: patch CVE-2026-90785 [meta-multimedia,wrynose,7/42] fluidsynth: mark CVEs fixed [meta-oe,wrynose,8/42] freeipmi: patch CVE-2026-85509 [meta-oe,wrynose,9/42] freeipmi: patch CVE-2026-85508 [meta-oe,wrynose,10/42] freeipmi: patch CVE-2026-85507 [meta-oe,wrynose,11/42] freeipmi: patch CVE-2026-85506 [meta-oe,wrynose,12/42] freeipmi: patch CVE-2026-85505 [meta-oe,wrynose,13/42] freeipmi: patch CVE-2026-85504 [meta-multimedia,wrynose,14/42] libde265: patch CVE-2026-54240 and CVE-2026-54241 [meta-multimedia,wrynose,15/42] libheif: ignore CVE-2026-84383 [meta-oe,wrynose,16/42] libwebsockets: patch CVE-2026-19773 [meta-oe,wrynose,17/42] faad2: upgrade 2.11.2 -> 2.11.3 [meta-oe,wrynose,18/42] libmxml: upgrade 4.0.4 -> 4.0.5 [meta-networking,wrynose,19/42] nanomsg: upgrade 1.2.2 -> 1.2.4 [meta-networking,wrynose,20/42] nanomsg: upgrade 1.2.4 -> 1.2.5 [meta-multimedia,wrynose,21/42] libopenmpt: upgrade 0.8.4 -> 0.8.6 [meta-python,wrynose,22/42] python3-tzdata: Upgrade 2026.3 -> 2026.4 [meta-oe,wrynose,23/42] smarty: mark CVEs patched [meta-oe,wrynose,24/42] libssh: ignore CVE-2026-59842 [meta-networking,wrynose,25/42] ntopng: ignore CVE-2026-84989 [meta-networking,wrynose,26/42] ntopng: patch CVE-2026-84990 [meta-networking,wrynose,27/42] ntopng: patch CVE-2026-86090 and CVE-2026-86091 [meta-oe,wrynose,28/42] ldns: correct CVE_PRODUCT mapping [meta-networking,wrynose,29/42] dnsmasq: correct CVE_PRODUCT mapping [meta-oe,wrynose,30/42] jq: correct CVE_PRODUCT mapping [meta-python,wrynose,31/42] python3-twisted: correct CVE_PRODUCT mapping [meta-oe,wrynose,32/42] php: correct CVE_PRODUCT mapping [meta-python,wrynose,33/42] python3-ldap: correct python-ldap CVE_PRODUCT mapping [meta-oe,wrynose,34/42] mariadb: correct CVE_PRODUCT mapping [meta-oe,wrynose,35/42] libssh: correct CVE_PRODUCT mapping [meta-python,wrynose,36/42] python3-flask-user: correct CVE_PRODUCT mapping [meta-python,wrynose,37/42] python3-aiohttp: correct CVE_PRODUCT mapping [meta-python,wrynose,38/42] python3-werkzeug: correct CVE_PRODUCT mapping [meta-python,wrynose,39/42] python3-flask: correct CVE_PRODUCT mapping [meta-python,wrynose,40/42] python3-twitter: correct Tweepy CVE_PRODUCT mapping [meta-python,wrynose,41/42] python3-ujson: add CVE_PRODUCT mapping [meta-python,wrynose,42/42] python3-waitress: correct CVE_PRODUCT mapping

Commit Message

Ankur Tyagi Sept. 23, 2026, 10:40 a.m. UTC

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

The vulnerability exists in GSSAPI key exchange introduced in v0.12.0[1]
Also confirmed by libssh security advisory[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59842

[1]https://gitlab.com/libssh/libssh-mirror/-/commit/88c2ea6752fab7b3da9cc4c51eaf632361a44080
[2]https://www.libssh.org/security/advisories/CVE-2026-59842.txt

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 1 +
 1 file changed, 1 insertion(+)

diff mbox series

Patch

diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
index 752bded528..49ffd29403 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
@@ -58,3 +58,4 @@  CVE_STATUS[CVE-2026-59847] = "fixed-version: fixed in v0.11.5"
 CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5"
 CVE_STATUS[CVE-2026-59849] = "fixed-version: fixed in v0.11.5"
 CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59842] = "cpe-incorrect: the current version (0.11.5) is not affected"