From patchwork Tue Aug 4 13:11:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94462 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BBFEC55838 for ; Tue, 4 Aug 2026 13:11:25 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.36]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16080.1785849084080459144 for ; Tue, 04 Aug 2026 06:11:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=YKCkDU7d; spf=pass (domain: est.tech, ip: 52.101.65.36, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=oXs4+g7NHeM+hnpGVtGfW5G50XyJwl2sxkObTSBe3whHxv9Mw+akTkLhe06w7YivTuaCSvGH/GIk5eJ9Bo1ZisE1gbcyXaXpq9eFl7OimLukk5nA0ZHegCPD5TV6MFRmPpdXHRIyQ5PQVF6Bp8YoDuhvvopg6IpmBsmKRutuQsPF2ZsDpS22KEGIg4wzVgDwgY/YCWv558s0qEhvVx+QIYXdAANF5iFyNP3JHadIKATYkl0wGt6zt5nbBDxdIFR5yqtB3NjNjPad5+aO1dS167FjEPtupyc1ImlqCKmLHYUuEFP3748wrjuDR7xC0adtBA/hX7999OvkQLUGZIzXbA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jAbQHnFuwhbcGCVWm+YIa7RktnCDaX09C4/0xsYxvdo=; b=CMOpp548A6rvUmGVZxP//5iwgNt5sNsWD0eoM54ttBT5PYx49YiLv2N9ybro9GdcaHOwxkkZPhP6Mm8VeaQAfNlLTZuOUaBTXQ1038HXQzKEiqiJ7l84MwBh6tzSRnXgrhOfX1eteP7SBQkCIwdO6DPiyJv8ZtIuNH9kZkE9tnDiFzzz9Oqqvq51Y8WDNvPVrdSIiwP9u3QU+fLn17wvYyj8+lFtbTX1J1l+iUPtADdpqFhSEbvK04+QHJUm+0h7Ufh1PAfh0OlzBgkHAHbOqI9Ng4IROsL3Rdewo5fcU7cr6j6BtiJIQTQxGHsMUqMxgQDHiGielzFOYFr7Z5+vjQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jAbQHnFuwhbcGCVWm+YIa7RktnCDaX09C4/0xsYxvdo=; b=YKCkDU7dmDlLjE/NMyOhYsnZAjRpFl7yWzBowbX4fRnpUEujyIIBJdtLCPZhYqkxlyvDHyrG6UEADfud4J6lY92W6PJDgcmctCRUcK3kc1xQyOvgtHGxbJlyZM04sYVpegpodbK+gJIBgxjR3/yf2FnkNfHlCH0fcM+F1EqepAT1UnUBvCd2xCN9ymn1vRuncFu2PYj/6f8nS77ZfBQlv7I4dFdFcirxz2PanSMCaRTF849YXJYpfvv3jk817u1CmNRf2PgbVo25M2qdif+oa1DPtxG5WygsyejL/4PXyuqjcx+C/HkVssU1v6UzdgUZKkKlOhd7ulzWyCTQSok/FA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by PR3P189MB0858.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.15; Tue, 4 Aug 2026 13:11:21 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.013; Tue, 4 Aug 2026 13:11:21 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [wrynose][PATCH v2 1/4] libssh2: fix CVE-2026-66032 Date: Tue, 4 Aug 2026 15:11:10 +0200 Message-ID: <20260804131113.3588-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260804131113.3588-1-jaipaul.cheernam@est.tech> References: <20260803084141.46902-1-jaipaul.cheernam@est.tech> <20260804131113.3588-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU6P191CA0047.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:53f::12) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|PR3P189MB0858:EE_ X-MS-Office365-Filtering-Correlation-Id: 41fbd944-6241-4223-e43b-08def229e08b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|10067099003|11063799006|4143699003|12006099003|56012099006|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: niCU3wlwzJTrgaZSFDACN8UTAI3FnNBQXbpC6zH71p/8KH5eyArTN1C7hlU+SGTapm7lzctpaHthmtKP8sVSK/pZYW28eI5qwFehTMCwNGrWq08E2emYxO8u9/mjuRfGB8FMA8NTv2okXRTQqZy5Jz8/g5aCFVsKeNX4IHMfVk+wGOtbWWBEK9AHUNovW0qODgS5AvtzxnbkvNTwPj74fVweabbrNHd9s/Oew58wJwioK74uJqVU5OGp8DUl48TkZlq/yoSCt4kSwLHBrB1XShDEX8FCVcJ9BPyxpLG90SBaGYqHKtj9hibbRnXrr0rwzXAW8JCtS6DHEprf5vPGygBvJ35BRm1xzvb2vFNwOHyeAoHcCsfZAWAFTatE4XO+FXX3/AQ690fGTvEl72VOK46R+gVxdJy8VOidra2cjTBJlfDp7sTyLYVZIVhl/L+pgV+MLVkVzJaW4507g/Nydjwg47M7FW0CH2mT/POv82XIKvvnXd9ZazCDKzxwC/URn4hMNwr7wYrB/PkjbnAkPHOvJC/CHu5IvFazBI6yC2Op4Arag3hxGUusg2HA6pzHVC2/6mH9IWVNrhADiy47nt/jKrIHvcDV5R1/vVaMKf4FSFEi5/6KYl4c0UzR3I19mlZq1v4POFRv499kYFPP9YnWlbVMd3Xp+j/BwuxEgsQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(11063799006)(4143699003)(12006099003)(56012099006)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ULPqeQYNEGe4BEIObsyieEDDncjnmiEY+tb7BIcGNOkjVqsbd3hQLrVYpze/agOMSepUW6mHC7XQCFkH6BGJIaw3z/BUVEJJSSGzy/rL3f3fXEfvdspZ5+9eySMhTcclBVEMvTa3MTY7dLS2qBBpMH2RHXXQikpskXp5RBj/SKEIkmYU+JahD0owNCAha1e6tJ0SpxfsZcVuOyaM/UxEeTWr2/B7RT368oAtMRBC1vhiOD6gHMQ6dOmsnM3XScxxAayQYNQwu7X8OYUZkAK4QvgIHfUbrT3tMHzTJDBBYkyv06rOIbW6drVNiyqhpNq1WaMYdCqcQqZCJu2AW6V4z8OuF/gXzEVBRDcBn965dgzgwqt9ne3YO/BsHCafSaRdu9cKJMEWlLg4z1wE53/cpS1/MC+6rbAfO3ExLC7sZJfqTzBmgEU0XPixdL1QFqRFCQ7QNSYuB98cQdkyUSzxdnww3/mAGD8Sr7+iwnmYGn7ryOD9IwjM1yMHsHjc3zQbiS57iU83y9RG1/NbWelUvuErNlVeU6wlcQZeZIFsH8OOd4NeqV+MOR2jcWqne6BQgOxq6PcES2agH/8dcxMACy/jwnfw+yioG1F922WV5kXZh3JT23mwnfvQ5eCAUhfnAhCU2gxVqKtW8e/48JHRfMSHPxPhU3ZvAvqb4QZb2GZM0HoYsaDChVLpX+PbWVwDiGqKp9dezFyKEl4gEJfHR0iO13RCvlcwgmwsMRA8oa6748q4hDsFKTaAbl5Dh720F+lG+gjbuvoyboMs7A1DqewdQ9Ak2j5nFKHwlNExrPwwl6XNxs6S3QaIPpS33sYlcNkxy2OVre6dSxyG/Cs1jaN87OqzinW6XFtA1KRRR6VqVu7W0GEtjJke6g8WDPa119zg9XqEhDTdxOU5yGR7qbDMqVoQXT6PadsHV4RcarxZGgvIJb+pj6JHPbB2o64fXaanoJxHTfzWeR9gwz0t6g5VA0U8BI6LBnV8d3ZsWOyBqQ3lMK1MjAUwPQVxri9FnJ0b9BE2XDg6TaYND2YVndbgDx6khVP8LSgXjqMYD6TJG9Y8RqEaFFBmwdsex6ZhXIb9kN6QDZDWEEVfgGzO+2TdUaiPvChQTJIwMkNa+5bBUskClyrk+GP16B+HFBJJQBQFjF9M+X24ApEiWaL2IgYyXrRolasSFn5hWJoDkH4NlQZaqbW6K0GiGh15eaTyGSVutt0NTnB7q9SB3kwyPvAO+2Bb3q9VFjw+SKvDutNHjHj6S6HDhcqFXmnBMNmUnIruO5QvUcZV2GANW1QwxG4aAWrvwKaM8LPkRmbwmDDH6sXkKFDNx7TBG8b/qeltdfV6e+za3ky9ViLRZ7op2BR/q87zeJHoiyqKFft+6+HE3LfxPjWW1B+z4WutHtf+CynXqSiM/e9mMtH+6evmk+Wrfdyhe9fP326Bq2IzuxmJNUDeI/yVa+688V0ZMl+PdIjnwlhUdmtB+1Y4BbygNvb4L/xHSlert20o1xiGjo3hokOGIgWrB7n+ZprOm/mmRddLl2nU4QJMFN3eePR+dppvWPNqQFDDgbcAfVBzDiVGgWFrognmIX+uLOPVDF5WpfbZhcqNWwqluykcKXhn/tizczbe0RfrMMZxdNdKxnnc1sd7EGqVqDHDcbCU0XB+LlIm2w94tETFe5rTEU754wA6J3BtwpmNY2OZhkm4VKV0s9aqpvhTxAiv8NMUpuNniNiXtITqvnDuJMgvn0l3VOWHEVwYMNoY9AWnU6zSSa0= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 41fbd944-6241-4223-e43b-08def229e08b X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2026 13:11:20.9465 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: G78XSbVWW7ZYiiQBvVVu7tD2Zp58JseuyqwXOc/h1xv8A84W1rLwayAVrlobFJ1VDf/r46HOGpiABn0JuAYJpRMS8kBXMcLuVkqm0giCpfk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P189MB0858 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 13:11:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242759 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66032 https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66032.patch | 36 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch new file mode 100644 index 0000000000..15a5266485 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch @@ -0,0 +1,36 @@ +From 352341aaebcf91ab16e7fcff158fef4a3b8c32f6 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Tue, 4 Aug 2026 12:32:31 +0000 +Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180) + +Set data to NULL after freeing it to avoid dangling pointer. fixes +GHSA-px3w-7g75-hg7w. + +Credit: VladimirEliTokarev + +CVE: CVE-2026-66032 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0] + +Backport adaptations: +- The upstream fix uses SSH2_FREE() which was renamed from + LIBSSH2_FREE() in newer libssh2. Context adjusted to match + the 1.11.1 codebase (different line numbers and surrounding + function/macro names). + +Signed-off-by: Jaipaul Cheernam +--- + src/sftp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/sftp.c b/src/sftp.c +index 6ede3111..793f267c 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -1279,6 +1279,7 @@ sftp_open(LIBSSH2_SFTP *sftp, const char *filename, + "got HANDLE FXOK")); + + LIBSSH2_FREE(session, data); ++ data = NULL; + + /* silly situation, but check for a HANDLE */ + rc = sftp_packet_require(sftp, SSH_FXP_HANDLE, diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 32e1ad6c16..bd7d1f7b1d 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -16,6 +16,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-1.patch \ file://CVE-2025-15661-2.patch \ file://CVE-2025-15661-3.patch \ + file://CVE-2026-66032.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Tue Aug 4 13:11:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94463 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8EC44C55ABF for ; Tue, 4 Aug 2026 13:11:25 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.36]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16080.1785849084080459144 for ; Tue, 04 Aug 2026 06:11:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=ilEAvVLW; spf=pass (domain: est.tech, ip: 52.101.65.36, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=KzI53EMSiOybEF4dVfY08JSKxJSIUMWz1mZtbzhxPwBwPG8Cu2Z83frU3unAai779ULYE08/G24Y7YKX/5xkL4s6hbVDgLVgPBz7yLT7QavUxfPTq+YPd8MKBHUOUMdhkCibb9eFrSGaGQ6pkarIxscZoaxfTpfED84XCqLN9rXs78pm64DUUszy3VMvlMfOBAHQg5NtAWYNAu6QXHDoSWCE0krLwVjh3dad+DtktE22Yrs0CYPu/WI8ljHtllXQ8pVFahIWMlsWN4DtJJVQxz5RFl3gNr6VftZQlq1gTUeRgsd+fiU/8sJQwh5WsQkjsFxR0+Nxxn6/vk6KWu+7tQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=iCxQEsfZ2I471yXM1ZR33KArQ28Vp/a/KH8yj0NKvTI=; b=Cig19CX0/IC1XzJymkeGdtjM+r+yWAz+UukNUNzBQIx6Ap8MFBZtW4UOubDM1YKy9HvE7N9jvBTcvJMVMMPljFL65dJpsCWwykmlBf7gz43eCIyVWbXn4/vXSQj1my1pJNAF3M0B3T2xGMT/W/Ixm9ilY9J4w0h4xq4BYiQdvXtJJaXu9afGyxL3bCzQl1cOolOHcEYpyHmDIdq/bq00L87Oaa3an0bMvE1FKxYFuUBsI5YdhEfIJkTkg0vyi8w5KhZ42nmSLiUCVL+twOY63W1sK3Dz7DBKWStFGRbVZTRalxu7zRArXZXKondiMyNQCwN1VrIcQKF1z2THM6OlXw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iCxQEsfZ2I471yXM1ZR33KArQ28Vp/a/KH8yj0NKvTI=; b=ilEAvVLW48EznbJp8AYcOhv5AlnE621l6ePAFA8/vd7EHihphq2a1SO+cWph6bVWN/WVTh+0Jfp0ZAezyFozXAxU2VTeJh6L975h1qKfDhmP2U94Ikq2Pq0F1DdFTovwqY9gcRq2XwjO+2fG6d5hlRUKUwDE1XAQqRUNXG2gqkKgt2eES7kAXpPUplWKlDKCYJmSKA9Lej2SLTA0ffd+jaMzlK0QXxmQWHLM5OcsVh6JVBx4g12Wy3Ls/PYXmbXkxPb6Zd1IhuNIyqwpNefb0U3QfbyjNToWtHxM8CkbEjo7u6o25Lb9eA1WXn7YA+M+7zlI7Z4p+J8U88Ff05mxvw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by PR3P189MB0858.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.15; Tue, 4 Aug 2026 13:11:23 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.013; Tue, 4 Aug 2026 13:11:22 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [wrynose][PATCH v2 2/4] libssh2: fix CVE-2026-66033 Date: Tue, 4 Aug 2026 15:11:11 +0200 Message-ID: <20260804131113.3588-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260804131113.3588-1-jaipaul.cheernam@est.tech> References: <20260803084141.46902-1-jaipaul.cheernam@est.tech> <20260804131113.3588-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU7P195CA0025.EURP195.PROD.OUTLOOK.COM (2603:10a6:10:54d::30) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|PR3P189MB0858:EE_ X-MS-Office365-Filtering-Correlation-Id: 70021edc-995e-4fde-7199-08def229e1b3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|10067099003|11063799006|4143699003|12006099003|56012099006|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: Ojo3mVaosnClxa5ZPCaCNpVvueTSQqFRhyxtWzQllkaHfY2UGernIeIgvGqrwPcZeuljsa2uRwwszxU4E3dfHwHTqxst6Tlx3IgmcvU8E8fjgzaeMV6p5HgQqaZB4CKakXkuSxV+STFUp8szfwdUE+VWP2nXNYblKHyKzHMglS73cBlV6F0I8tMbw+ArTTrAZAxW2SWfuFAfeShKXFo/ReDHeMC/HXzPXXoB2leK2FsK/zI6mNgNnfx/bdrIhGqZMe/NRtMsK8sVqLQ5F2XTCpt3974QDSBDYilEoIwOOqYpbeFcFSF/IxveM89pRatjOuYHLiYOg6vrVB4RypXWzpSdRuXjNvxnwywcpOz/cBba5BQGiH16l05qKciMmHuS77SsdqDVzPzVVizYLwLNqOZFf6ty5tM8XON9LCp0CXci+Iq56qaXUZj8oO+D0s1aLzlYtiTtjChsIn4GE3TY2XALU4kE6gbD2wOQwbOs5DLnZxrgw5071/HtZsNGjQ/ytt8EMQ+2glXwXEYL7w5B6eNkxynocWOKjUCoqhzffojzfhnQ+sRfjpW3FiNacSu3Y6viUk09HTiEw+XBMHWRyYBk3G3AWUvRA4lHjibhQAzn/calH0PF8VwF5L4zV1s1A9SHg5YN4CXxYGbdVgKm68cESvGg5Ybp6+XDE4sfdgg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(11063799006)(4143699003)(12006099003)(56012099006)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Zhal62CtykyKjyJhFDF8w0RQqRG0W6PHCX9s0jiL5kWBfIW8WzfCqhsjWECVT3TSkOF/NLPXGJuYBb8yNOxp3T9MxEX8DBFY2b831KO9mv7KKG9DbDRKPdOnUjjcARSx/umdo2uM1AGNnzn2dzonw88PuzA9TADu0UYfEBKcyMoKnYzJzTCgHwxhFUWpMXwLHT6m07KkGTMV/8wgdy9+e/WL42TjsgShM7ysZBcAtaUSszp61j+O5YifxVq9NHO/B5MKpHQkm8xf7H+lKN6ykqp3V3EzlIuDSHLwgyKSWY6HxY4E6g5oIMM2Dl4Q/9nbnpCEtc95c6/izhQnnitGN9Ws2pnkmFu2Jazb96C1BViHFsJk10BApR0f0uZk6q6/QPktooCNgVleo4l/mjENHG4TS6KY0B7IXmmF/t66kMRskbmyw0rvF9Lq/awDXkUuFAldPMlyaGEtaBIMjRUy4kc7L7LZ+w5PmQMqz0t6JsGKPNOCSii0/5zgam5e0WE85k+LA9U42WH7236pRHg/oNOpfurSmjIYxmkD4lFsnyeiIcQfWsbpfzvM0JCFrP1wI36wb3tMvA9if5mh+mpdHMLCrwJXn3ESnSjk5sIRX4r+RMCIZaEoLmr7D4Q1a0ztbFwx3VB5S5ap4mT2kSukAzRuBYpjmEfXAikKueT9TcPk9+Z2JiA9mSQmE30ciejdeHO/VGLvjmKJUHiddjZT9RU8mEd0uVnQXAeMdtft8ymgBA5OFWlrDHh7OvlKk01W22NyxUoXzb0rF6oxB7lj17H9PEib7FdeMVCuQJ8yv1E/E/WrgVruXgecqHINkJiIQoPZ6xMSMTQVZUG1E3W3LsggdMQwg4fD1dDKEp8hF9ImMy28rATrONK+KtLz2B/HAthh++MHYaRZ2FPchwK7wXHU1NaPYBtDqUAQ5Z7avmQ3NXTpaA33jDKSyPtIt8Rl2eIyeL+n5qfjRubq8bSV1YjYEVfXjDfTrRD0Lnjy3EzCaTY3YbLJWy3GvLJQsJ30kwwyHM9diUvR+NMnSKgoZ446fqB8IIdskrq+e7Y7Ehek148fOTS6NSNE6dVSBROm57n6zr9w2t2PVBKXgeTIWv9Pogm8sAe/qAFvxIurM7Halp/pOPFlzLPPh8OsSsavAmkoqtedT5ZOznIhbwRdNnmJgQkDI3lUkmjdZniceoax2HXxZI/ndWe3pQSJM7Jcp2WqfElhOa9nAgyE8cRo6+Bdo1VYiBfn5UQ0q+uXrWNSkJbJn+rJXzzEjnpr4/qrzZZ2g6o6ITLMQ/VDZIB6Iqo1ESNgbCD/KpGN/kNjdd7h06iVrs7tObJytYuTIoGc8wVaOi9nyX55JOC9ZOia1XayAZGsGC7k6ygEYvRQ78AHCB81BQXJL4dRHLNJf6IkhHByF7sMK5KtbTjh8knC56nErBfPbR3EGgEfrXYUN0/nMIwg8Y4eNaO8RN4zdCjV6SZYa3B6R2l6UrNRRmzjqgs2DML9O2eSJfDZLthatrPnc+VTeIEVC6Dtyls4R4CPrIW9a4cgWHnprw9xpSSnVd1zacE/LeBwk/jWOY2tKaURvO2MdoaukV78dR+8N9kNAohd9ZreHdG5zxJh5cr+vSdCI8y9hf5VbFdrMuWxq/n/w8ZAPZ4f1KnQBdYhBtvKa4ZCDreLOYPN+dDGTR7SaMf5pE+yB7ekwFnw3o/1CDwYsG88cuxdoZ/J5fT/l693zHIHmViCNVAqq/VO7JXd1j7RmmAilVvLVvkiMwb3uD4= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 70021edc-995e-4fde-7199-08def229e1b3 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2026 13:11:22.9160 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: SQdEVPRLNhcPH+cQPKljrxX3dBljRekDhGKLXvT5EXjCERyXfsrQF/iEUmfUCIWdjEirMO6hcM2UOHyCfq2FbLQng5eorOvKeHHu3BGy5fE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P189MB0858 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 13:11:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242760 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66033 https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66033.patch | 45 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch new file mode 100644 index 0000000000..bb046a6eae --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch @@ -0,0 +1,45 @@ +From d1b6996c3b31ce6b60d5a820ecc33880e61ef0ae Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Thu, 23 Jul 2026 10:32:04 +0200 +Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in + `ssh2_cipher_crypt()` + +By applying two bounds checks to non-debug builds. + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-c4f7-cvfc-33j7 +Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 + +Closes #2401 + +CVE: CVE-2026-66033 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6] +Signed-off-by: Jaipaul Cheernam +--- + src/openssl.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/src/openssl.c b/src/openssl.c +index eba05031..28ae1cc0 100644 +--- a/src/openssl.c ++++ b/src/openssl.c +@@ -1042,13 +1042,15 @@ _libssh2_cipher_crypt(_libssh2_cipher_ctx * ctx, + const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0; + /* size of AT, if present */ + const int authenticationtag = IS_LAST(firstlast) ? authlen : 0; +- /* length to encrypt */ +- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; ++ unsigned int cryptlen; /* length to encrypt */ + + (void)algo; + +- assert(blocksize <= sizeof(buf)); +- assert(cryptlen >= 0); ++ if(blocksize > sizeof(buf) || ++ blocksize < (size_t)(aadlen + authenticationtag)) ++ return 1; ++ ++ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; + + #if LIBSSH2_AES_GCM + /* First block */ diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index bd7d1f7b1d..de435a836d 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-2.patch \ file://CVE-2025-15661-3.patch \ file://CVE-2026-66032.patch \ + file://CVE-2026-66033.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Tue Aug 4 13:11:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94464 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC9ADC55184 for ; Tue, 4 Aug 2026 13:11:35 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.0]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15930.1785849087911943524 for ; Tue, 04 Aug 2026 06:11:28 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=p9wD3JG/; spf=pass (domain: est.tech, ip: 52.101.69.0, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=xwkVRI7UNHU5tIWX0eWvc42NqpxngTbfH3rE/zPHzYjC3D8QxgH6zTqcHjdP0lGiTGIFSjmtC66fhZiq1WaAXTKuSiOWQCTOc7POki2NtoBGde1+qS13lPjrGizlXfamrR7wH8jyVBd9ikBRiQBlElFjYrUoaUBtqFoNB0zQA9akSeSH7u9xI8XnUw7Avfvk0HR1L/qAHuL9K+Z/cDjXcD0zzEV7sqCmDP+eQvaLzVnVC1sKvmxq6ABMf0D2mr5oIy2oRi0PQHsX2pXoqcyR+rXKO314H9ceUzz0ip8qw5JkaxUAyMVwli18NO3mLitQGCtJZw7PJ1VXJ4nqoAehTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rLKlR2Jddiv+cjmm4UNcy9LzVaXsGq3ELFLbGgTku68=; b=KZOdSlGbpuJVLYmODvsc316LAp0XUk4byFZszCXZSbnB30Je0h3PQ30BL4t4VppFRw1lGpe21bVuQZxFTjZprxZ7kU1LjDgUKbgDCbFRg/Xh7eb3iQo6XiJyDZdvKtpZaHZMjrO/PTjfE5efAs+t3sAgiDVFERRCodlxlv0c27j8zwcErJG8226LFXqDoyy/lKwwZmFJ9sepMpBPDVulKyuwDZclK+nYTSil+7u4kr46kV9VIttR7i+uXfW13fKXnoI5LHaYnqP1MIKsc4E9I5ie+91pmeAJVATr1GC4pE5DZnFRV+8doeBIh6J3vqnnKBKHkU/gykFG6jOKEDT3Xg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rLKlR2Jddiv+cjmm4UNcy9LzVaXsGq3ELFLbGgTku68=; b=p9wD3JG/pjUxXLeLxBrHj+0LzDTZDg8oUEkHZwfXSI/mypZzZ0QJZRn0MQWArsd8sNitQ5/rM4TQL97KxDxHiWuZbM1T+HDXEKW4gIjg0RBZTIiWmdrp5jWrHm66/V3xNewsqt3pvAsqG7DutCbHar4bMAg/clsIaXgdv26lhbD+uFfT7HA9WA8WnhITdXeC7/A7a0Pgtc8HsxoSX5KLE8IqkgGyMesKVQf5uMVM/QSeZlXx1ZXfCgLIwNUx1zyJ1jHN9spse3dWnhW6ZjjKecnde//WiwnzzZFXgm48/PrYxLIhY0f7irDgcCTS8Q1FvwDU5RnPdBIFsYxhlu3A4A== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by PR3P189MB0858.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.15; Tue, 4 Aug 2026 13:11:25 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.013; Tue, 4 Aug 2026 13:11:25 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [wrynose][PATCH v2 3/4] libssh2: fix CVE-2026-66034 Date: Tue, 4 Aug 2026 15:11:12 +0200 Message-ID: <20260804131113.3588-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260804131113.3588-1-jaipaul.cheernam@est.tech> References: <20260803084141.46902-1-jaipaul.cheernam@est.tech> <20260804131113.3588-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DUZPR01CA0249.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b5::10) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|PR3P189MB0858:EE_ X-MS-Office365-Filtering-Correlation-Id: a8365115-6002-4bce-7f33-08def229e328 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|10067099003|11063799006|4143699003|12006099003|56012099006|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: vrzmY0P81N4vzRpQZZP0M/a1Yy43rS6VAn1kmfQpBSTt26cfgaeQqcrisE/Nb5vOjEbmmQYBWovmpzvj1+5iSd80Tun4mVK2XE7L/S7Oj7mxIIP+FaGygoni4jz2T1nkdPSe/vWxArDWTbuC4p6nVYsHj9vlofQ+PDZBM/85wP+a3E35A6KvU+5alKWLwpFYfYhaR17gpOiFWIX5HUkf6QdPAO5QOiVMxtcNJ7oDzPZoUl91Ef9JzgBQ8W5GCIGtLOFrLq+ZX3Tkn5Mlbmvvb9g0PRkz2+tXLxxeFtKfTpTeGC9EYe1vk87Q6XSgihlZ+AWqTuJj4h02e9sR92V9ORZJ847K36RWkHwN58ilthQIEUUeB9Phgx2qJsCZI8LJAc588DpOZYCkpSd1PLiwynOCf7/EGMaPdC6YH+n+lYYJi4p7OZWTa4BYKuBsQ6eB96TqdsXAG7ku8nsWcBK3TzNhHaPOIQ/3BemvHp1m0PzLrOtoX8tvXzyBToZqkCPZcaWT6OfuDSeqUicZBP7uo1IfwydeAAnwb0h2U/1zobRTkYktuoCRlaPXepKtoT/+b6SsJu/1M5HYynOsa2i0FuYuTrzH0yXJMM2qAu1r/nqEJCO47jvXdJ1GBBnrZStw7yib0mMSx6kIVrnCR4nA/9dcQUm1Klb5Tw8KCJ6B0Ok= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(11063799006)(4143699003)(12006099003)(56012099006)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: n6qkKbAeY3loYoHy4XaPsbSco1AYzowzNPiHXGeHgtN8FeBKRm0KYblyoJGu26twql8GvkZtUNLOxa6tNZlNxtpENYdpv16JCE9dgGU8Is26M7YR2xUvJfzkoya5sj8UB3YAIJ1nTAexdfjwjdvxcg/83FnhhCwyphg9bGONsHL5UZvUZh1YCZ/Cjxn4sp0fYnD5z0GFGV5Sv9L3naaEp4W6dstxuBd0/u4J4hIOgnSW3O3wY+dxRU2MsUW/DJXLn0Klrte5roQfXYRDnnnY+DQI4x7v+0ACoRTmTeefxs0yXMFMFoDdp2eBCSkGfGZrOSmBjuLLP1OHVW0sCLHjDDwchnwUEx5dqk2UVWqTMJC2BEpVG+x+gtEJpw1rJ9GkW0KKMTIqXeXezHI5VYIFN1B0mHN5nv//RJ4aI5KSoNkDLArxc1lkzIg5BKRt/ohuLuECOnbY+gBeHcxngqH/Ix9XKveQqKG8SSENTzhkACOYG+7pJDnGmGEf9QVFcwbxE85Usuemze1GSeLpNr1h9tSckv1EP8djhNlTtGBCJDr9t+YilixF4T+FTpi9uRTsKVFS0GoOjV+M9/sZ81lTh+tc4k5nTDX0YZcZ4fDatIOBi66hDb6G8sL3DJRQfmYqpMxq+QRhmlls5wf0WSw2vzL+P/THfPRjxhFhyUR3Uheo4/OsrCQHHUwmhCHVwSLyT0LTp4BX190V3rJYyKqLqZTEgitrOnFbJksQHu9/4UyTg6cyfjfbMdMIvDCDHoKi9Cji7UHt7bMndZWj0FF7wA7CsY68UwwpUdvb6V9KbG1IT/hYzYBoNPVHgDw/b3PIXqhobFDCuOqF/gYFmWiT3C5GVRQQBxK+Vj9mCGBcAKWe+bgNbguPdnQDUFasMbt6kWmtze1nikTt55lg3Mbw1c8m6wuPgkGSN+U5fe6+G9cZ+roSj4hME/Fl+0oX5JDyI3w7Yv4fGrRg3n8csemRySYBJcLuPlhSkjaaqAgBx7SS0zVrebI7RCtIZkhdLseZTkyEkHSoe6f6J7jp4XJmwz8mTil9w6W07yafA/3cg2eViLQmuXhOE9qAMdhFhF+8zygm+lamXXLS6fxAXwLZH/ZFcnQ+w9/G0G64JsOyldVenZMm8SOvkimSvB0u4waJ0m4OOe3bKY24t9f9ZbaV4ex6YiQV2Qwj7HP1Pw/s4eROIzT8b/+I4Zf/siaICT/jiV3nCJrdohTU7uwRmxzLIV+En9HjsbvlX7pqa7jKfAj4F2kGtN7zOWjc8XX2NjNITtPrUYq0YOB4jAJdLQ+30Rk9VIQv+qFDDVOet0eaTbmPejrJAyJ32OzjxrcKYOIG3jk0SGGtjvtUicgwvoTC7DKoGr94NCy/rs6T6eqZdKMmBJ5kLw8lATVG9T/5+G4/vUfipaGHRocieFy5x4yj4j5L3KOn1WQ2oWeeantd/sN56Csq0FbM05J2R0QpeBRAXsriBGqX2dQPIRyuJFe/NWjrygPMOxmBhmMojyautwg9h0ZgysTRdvXzsZTaUg8OwHK7kSGpVJgWFK1TJteeOAyxRuh5dyaR9tDVOY+AeaOKTRdd5rUv2ZUsOuokgBaYqXcNUQmlzA/oPbtql48WCH+v7RlpV32ftry2j2iEdVxhEfGyFPbGVJtAHln57naVXm39WExR6EzIt5sLpNYc+8/GcA2iT70Dw8HpVi0FoCmQxwogq4wzweHDzlMw8tJWAvI/wzMKi5ziHET4rrvyT0hUZzRomgm2wKPU1weBT2w= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: a8365115-6002-4bce-7f33-08def229e328 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2026 13:11:25.3908 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: E5peHtbqLVzfDHjLntyisl85iSc2DngIILKXa9uludXr+C9vpY0TQGz49ecVwSHgc2phr4D/1KPRhqFcYeS5tGn1ymm7ZIGPaVSGWvIH2eI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P189MB0858 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 13:11:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242761 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66034 https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66034.patch | 40 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch new file mode 100644 index 0000000000..906356baf2 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch @@ -0,0 +1,40 @@ +From 16720054e0b3f02e36f31dd04add534d73d4a18d Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Sat, 4 Jul 2026 11:19:49 +0200 +Subject: [PATCH] publickey: fix potential OOB read in + `libssh2_publickey_list_fetch()` + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-w6g9-cpfp-22gc + +Closes #2202 + +Backport adaptations: +- The upstream fix uses ssh2_err() which is not available in libssh2 + 1.11.1. Replace with the equivalent _libssh2_error() call. + +CVE: CVE-2026-66034 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9] +Signed-off-by: Jaipaul Cheernam +--- + src/publickey.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/publickey.c b/src/publickey.c +index 9c9fa618..f3776d2d 100644 +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -988,6 +988,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys, + } + + if(comment_len) { ++ if(pkey->listFetch_s + comment_len > ++ pkey->listFetch_data + pkey->listFetch_data_len) { ++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "ListFetch data too short"); ++ goto err_exit; ++ } ++ + list[keys].num_attrs = 1; + list[keys].attrs = + LIBSSH2_ALLOC(session, diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index de435a836d..7d3063d930 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -18,6 +18,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-3.patch \ file://CVE-2026-66032.patch \ file://CVE-2026-66033.patch \ + file://CVE-2026-66034.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Tue Aug 4 13:11:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94465 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2AA7C55822 for ; Tue, 4 Aug 2026 13:11:35 +0000 (UTC) Received: from DU2PR03CU002.outbound.protection.outlook.com (DU2PR03CU002.outbound.protection.outlook.com [52.101.65.67]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.16083.1785849090193362657 for ; Tue, 04 Aug 2026 06:11:30 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=tOAUCaLH; spf=pass (domain: est.tech, ip: 52.101.65.67, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=GSdUTmwe6OencxCItVB4jYTG8eKRCE+HOiTZ//Vrtr6tGi0fEiJGPndbNeE1f0XIOhHIV8sibxnEX5tnYgwkoCfcNCxU9XAUgSJmWA0DGEgiYdJOx8HHPr3DKRB1Ofoh6fcRY5bA6v8GQnGJoZb1nqwOsg7+yaDVjWaYTGqMtI1asiocdmRL88uR/r8kLEUlY2eAC0rYgoC5KM7OhZFVjkvhY57+ofrg5kVrwX+yPs+6s0Rld7EPcpqBL5mlLuhxDU62A4QhvTdz/e+yW6RFWI7r+49hrgrB+slmvmaSVlGPmIEqfofi9MVu6NYSV2oPsKHSJu/eCFhu2mjr+wn4Yw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LSgYssN5W/+YpjeJO379S9IsoQesnK4x+LXiKm2UcQQ=; b=NRPn/LyeWN5euLTIp7uCjeY0cy5eJvNf6Kg0qg5k/PWRbj+gBdWiCtQU7NcaS9dI0UUQQ5xRGqyJA/jnDHLsG/TGPrVtgHkcMm8oDKBvAxsDfqme6DvGBb1cQmt5fK2RWPZUjAr31rh70NUm4rUrkxwIaoRalQVHYiblk4Nk8WFyR853FBZgJ1ZBDfUT3zJJcKDyfmkG6YUdtyGpSjfE0RGO/p3x82EGz9x68q94ljwYxbI7sE5UYz+KBhun299QYDHdC+9tzNQqpExRkxtjTdVN1utXTWVmny13THQWueoVoGAt8JistvUn1wcrWtbsuuqDc/I9UUz+Fg52lUNWcg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LSgYssN5W/+YpjeJO379S9IsoQesnK4x+LXiKm2UcQQ=; b=tOAUCaLHOvQWv+cfAEHGpTVHgcA4J2N4GA1cW1W7/wNxwTLDmEwjWzf8QK+cCte2/CSx/V/Wz3f4E2NPbOz6iVXWWvAZe2aC2s2O781vERkdUR9nGuiuWR+gy+ok464i40wZcLmCUCjTIXFematqFO3vJKQOUbW78+sTLEQ12b1F8YTeRjYpy7lHKLfSKa7wGLfmwd1rnULY/7dDogWRYaJW08+3pHG75FL7FPWFMHQwImYwnY7yjH9iFE4mPyavCZDciM33VUGS96l6KyCzOVnvljcUWRffJZhNziLZcJ3KFP0n+/OWCqmLcOwxEcUpW/C0OlWE/fcaD/j/Aj81yA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by PR3P189MB0858.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:4b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.15; Tue, 4 Aug 2026 13:11:27 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.013; Tue, 4 Aug 2026 13:11:27 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [wrynose][PATCH v2 4/4] libssh2: fix CVE-2026-66035 Date: Tue, 4 Aug 2026 15:11:13 +0200 Message-ID: <20260804131113.3588-5-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260804131113.3588-1-jaipaul.cheernam@est.tech> References: <20260803084141.46902-1-jaipaul.cheernam@est.tech> <20260804131113.3588-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0018.eurprd04.prod.outlook.com (2603:10a6:10:3b::23) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|PR3P189MB0858:EE_ X-MS-Office365-Filtering-Correlation-Id: f98b6d9c-979a-4522-fb9c-08def229e48c X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|1800799024|376014|10067099003|11063799006|4143699003|12006099003|56012099006|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: Cx9qGRmEs1RbWZAKlbPrYe1M+43X2euwAzDy1hdtOkd/HjTF1qNC+R5ON9t5h9udPQdkVlurmFQbPFP64Ow9rVnQSf3ZjPbV0Uc4V+Ke160Yo7zYk/JOKCwTNJt5bN6n42cxStZt61zWU3aSi/Qcezup12NxXzcFIJ/nC6xCLkCLsrQtjlt3T/lifY1G2jPrp/4ybcIq87AuqG4K3Pux+qqckrsMsHoaQOlsdX/yU+KqTUkZiQfZq7qWmfcG3xwf1xzH/L4UXRAz7X31ZgC5DcgQUzxhlJZnXi0a/qlUU+xLVHXvDDkxqWTcUkdHbxLqFyBUJRrAgu0BnckACWt2hFOtp8fxJXkeovTfn1skZBpElykOlWtMF0dPyhn9VnlSYau+77mYQei5yKY1jfg852Lj+RdmrRDl05SKnfDT7n77OP7NY91y1tJcpTLiWQfxwHa4jI/aNvvEgIPd9Q1duXHsEvkwC326wUD8/HjCd+XYi7BvmOYHh9FZzfSMV4COoknbl95tlSjg4qzAWQCIdlU2DaA3mUReVcyvO5Z4gnRNjQSi96fAkONIJLDW1ogd80SWYtdOydWWsjNfeaCTiOL4FRIm3bKayODVZ40+siCKfu5ZeKSWTUOJQEIzWyTJ1Qs0rhz1HWsNhW/16HRlXhbwDF5OKst08Nh0oFsdoOM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(1800799024)(376014)(10067099003)(11063799006)(4143699003)(12006099003)(56012099006)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: whxu8FNPzWckPQAWiHTO5OYB+4BJ/PJg400bb7SJK3Lbarv1aw//n1ZLGdII3UA3LaOY5wPNl3MuSb8CAPOl+ToeO/QN15LvUKbmy5A79jbdhU2z1psR+bEcRBf7C5ZSxJdCMoNfOIOte+4zhYtiYY2tFkqEXRT5XEY/VDL8RNWiWwycaDJTTduYsIuHNMffEj7e4Ax4uczBCX8ps/sxFI3WqPWwJRUAnO4nKFt+8Klug0wn2gOneGn21PdoJG/KFB+Amul6XZP4ZVglsB1WggWUASzsXOgkYfnHwBcRqjKePf2Bm9gCVLIZvIUdnVLnQVUbucORKb3HNAvisClvqhBrOZif9pVL5wAJt6MQECk4CHXdW1CaAkEGXvtSBXMY1SqISzEB/aDru2b1ckMrNrvPzumTRgLfUz6PxN3jcO4sIazOKwLkiGIbozUrUz0xnfDjTcwH+eoN2NMvHtSdolQEgJzFCs8dwojPzf/eL2nyRMomfNuAx23enoxODt8h9JK5YPzWzgYtbSuQKAzKc+PJUFSevwBNQAH5LB6lO1JAsh1qbtwkbxXsWutoinJikEsQs0Ip+f6/H2xvTZLNkPAzSnesQ6IXbRjS8wU/C10MXYPSc+x/0JgsCv0ZMez4DCcQpSBY50qBeS/bldij3mTcy4grw4sS1iJcPJiNy2NUSZiSSmRDCckizqK86EkbKb87k9Kzv6YatCNwjRfI+1ceE32QKC/QWBh7JEEqdca1G5AoH+hjH/4wHazswdlRUl2lVwPIhvhtybg+Grnlmmik3ivw887jPmGnixgXxR5WJTuBVpaDsNsoNk1k+6icOa8DRbunG26tRTTRhRb53sP74rBHWwOKmrFVZ27D/1EBcpREOTw7bm5ZTNaQYb89loYiTJXsmAXs32Zg6xmNRajACrgenUKqzweKcyu8PExkgMXcul5a5w7RcK6R7xkVOANRQZROs4XEfwlBkkImlr3WqookPU5XNZK1N3t/Kd7dhjEq5KzhCXF8k5aiqJ+vOadOP/9NjsjSmtT41xD7pS1eIFPwP1Q8q1CIYkv2CYHR6GOsSH9x+Yj6gmGsVRMn4WkfUJLCY6yeYzS8261oV9pFVtx0SOo0CyQsSflNxIWV3pkd6fVcuCmPB3zbL3EbVs0hLOSt1yrGSC7sHwSKfdITt1Xd/zshJLaxKb+dMhggGQwLTK6/Bf0X2c7BH7QvrTgjcDouB8xpye6TC+vwtlLV+eTveQ6jQpzsYHxE3eKjf1BcPgQkUJ/iHUxDKiuRB7HUM6veaBQvmjfeI/HhyH+KZd72iBa3DUpyFviJ/EF2kIwmJpK7d7RYpJhEopqfg5fkj6+bMMV8ZBH0Yu68sMDGgjzlbJaf1rHCRUHo4A4IWCBa8ZFC/ImIlgYQKU7lYGLZr1YOYmK/IPnhwkhcUaCeo/FEg+Se3BdcQmQOhDGwx3U5a4T2Sodn0AhLl+90KueeZQChH4ENfCBYYBCXXb4ItFjh1RUtqSY3NkYWzzuTQCUwwc0HhmXhwQc3Bvy8Tx9b25748TX5yqbJXzrjhlR0gZazNEFGMUosbRkkCAIEzZ3JHygBi5BiTEDjQE64xMgVC+FQ2ompzc/gZgETvwxK0OmDdkQRg9Mv6W62SjnS7DAywqIc1vhr+n6JJuTYsPKGmlety+2HkF5Oy6GDhPx9nDDduK6GXpNb9TXNOeNkubhyDJDYxYyTK2vWjz0SDPyJwPbFZS2+oO5vKCdIAEMzzIlOZGIFgBJA+MeyXrs= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: f98b6d9c-979a-4522-fb9c-08def229e48c X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Aug 2026 13:11:27.6907 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: W0YBKigIEzrngXCF6AHfN4fDFdBIHh75lDI7TRlrcmPl4LbJcsKmBNkglMQLJ/e7eUsRNRCadr+/uDgk6ZbsuWpdhg84UH3mGddarDowYVM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3P189MB0858 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 13:11:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242762 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66035 https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66035.patch | 56 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch new file mode 100644 index 0000000000..7c15f92fb6 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch @@ -0,0 +1,56 @@ +From 6671019836476649792eea12868a370133be1abe Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Fri, 3 Jul 2026 18:22:55 +0200 +Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-6c79-444r-wx26 + +Closes #2198 + +Backport adaptations: +- The upstream fix uses SSH2_SAFEFREE() to safely release allocated + memory and reset the pointer. Since SSH2_SAFEFREE() is not available + in libssh2 1.11.1, replace its usage with the equivalent NULL check, + LIBSSH2_FREE(), and pointer reset sequence. +- The upstream fix renames decrypt() to transport_decrypt(). Since this + rename is not present in libssh2 1.11.1, retain the original + decrypt() function name. + +CVE: CVE-2026-66035 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4] +Signed-off-by: Jaipaul Cheernam +--- + src/transport.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/transport.c b/src/transport.c +index d147505b..9f386e75 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -242,6 +242,17 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + unsigned char *decrypt_buffer; + int blocksize = session->remote.crypt->blocksize; + ++ if(p->total_num < mac_len + 4 + (size_t)blocksize) { ++ if(p->payload) { ++ LIBSSH2_FREE(session, p->payload); ++ p->payload = NULL; ++ } ++ return LIBSSH2_ERROR_DECRYPT; ++ } ++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4); ++ ++ first_block[0] = 0; ++ + rc = decrypt(session, p->payload + 4, + first_block, blocksize, FIRST_BLOCK); + if(rc) { +@@ -249,7 +260,6 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + } + + /* we need buffer for decrypt */ +- decrypt_size = p->total_num - mac_len - 4; + decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size); + if(!decrypt_buffer) { + return LIBSSH2_ERROR_ALLOC; diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 7d3063d930..faa34ba3eb 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -19,6 +19,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2026-66032.patch \ file://CVE-2026-66033.patch \ file://CVE-2026-66034.patch \ + file://CVE-2026-66035.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"