Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libssh2_org for openSUSE:Factory checked in at 2026-08-05 17:46:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libssh2_org (Old) and /work/SRC/openSUSE:Factory/.libssh2_org.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libssh2_org" Wed Aug 5 17:46:46 2026 rev:49 rq:1369562 version:1.11.1 Changes: -------- --- /work/SRC/openSUSE:Factory/libssh2_org/libssh2_org.changes 2026-06-23 17:40:28.581465090 +0200 +++ /work/SRC/openSUSE:Factory/.libssh2_org.new.16738/libssh2_org.changes 2026-08-05 17:47:33.168051167 +0200 @@ -1,0 +2,34 @@ +Tue Aug 4 08:13:35 UTC 2026 - Pedro Monreal <[email protected]> + +- Security fixes: + * CVE-2026-58050: Attacker controlled attribute count from a + publickey-subsystem response is used without bounds checking + and can cause to a heap buffer overflow in a connecting libssh2 + client (bsc#1269568) + * CVE-2026-58051: Public key list is increased and does not + zero-initialized new entries, which can cause an uninitialized + pointer to be freed when a malformed response is sent by an SSH + server (bsc#1269567) + * Add patches + - libssh2-CVE-2026-58050.patch + - libssh2-CVE-2026-58051.patch + +------------------------------------------------------------------- +Mon Aug 3 20:28:54 UTC 2026 - Pedro Monreal <[email protected]> + +- Security fixes: + * CVE-2026-66032: Arbitrary code execution via double-free in + SFTP session (bsc#1272737) + * CVE-2026-66033: Denial of Service via integer underflow in + AES-GCM cipher negotiation (bsc#1272736) + * CVE-2026-66034: Information disclosure and potential arbitrary + code execution via heap out-of-bounds read (bsc#1272735) + * CVE-2026-66035: Arbitrary code execution via heap buffer + overflow during SSH negotiation (bsc#1272734) + * Add patches: + - libssh2-CVE-2026-66032.patch + - libssh2-CVE-2026-66033.patch + - libssh2-CVE-2026-66034.patch + - libssh2-CVE-2026-66035.patch + +------------------------------------------------------------------- New: ---- libssh2-CVE-2026-58050.patch libssh2-CVE-2026-58051.patch libssh2-CVE-2026-66032.patch libssh2-CVE-2026-66033.patch libssh2-CVE-2026-66034.patch libssh2-CVE-2026-66035.patch ----------(New B)---------- New: * Add patches - libssh2-CVE-2026-58050.patch - libssh2-CVE-2026-58051.patch New: - libssh2-CVE-2026-58050.patch - libssh2-CVE-2026-58051.patch New: * Add patches: - libssh2-CVE-2026-66032.patch - libssh2-CVE-2026-66033.patch New: - libssh2-CVE-2026-66032.patch - libssh2-CVE-2026-66033.patch - libssh2-CVE-2026-66034.patch New: - libssh2-CVE-2026-66033.patch - libssh2-CVE-2026-66034.patch - libssh2-CVE-2026-66035.patch New: - libssh2-CVE-2026-66034.patch - libssh2-CVE-2026-66035.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libssh2_org.spec ++++++ --- /var/tmp/diff_new_pack.ipNmM8/_old 2026-08-05 17:47:35.004115730 +0200 +++ /var/tmp/diff_new_pack.ipNmM8/_new 2026-08-05 17:47:35.004115730 +0200 @@ -1,7 +1,7 @@ # # spec file for package libssh2_org # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2026 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -35,6 +35,19 @@ Patch2: libssh2-1.11.1-CVE-2026-55200.patch Patch3: libssh2-1.11.1-CVE-2026-7598.patch Patch4: libssh2-1.11.1-CVE-2025-15661.patch +#PATCH-FIX-UPSTREAM CVE-2026-66032: Arbitrary code execution via double-free in SFTP session (bsc#1272737) +Patch5: libssh2-CVE-2026-66032.patch +#PATCH-FIX-UPSTREAM CVE-2026-66033: Denial of Service via integer underflow in AES-GCM cipher negotiation (bsc#1272736) +Patch6: libssh2-CVE-2026-66033.patch +#PATCH-FIX-UPSTREAM CVE-2026-66034: Information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735) +Patch7: libssh2-CVE-2026-66034.patch +#PATCH-FIX-UPSTREAM CVE-2026-66035: Arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734) +Patch8: libssh2-CVE-2026-66035.patch +#PATCH-FIX-UPSTREAM CVE-2026-58050: Attacker controlled attribute count from a publickey-subsystem response is used without bounds checking and can cause to a heap buffer overflow in a connecting libssh2 client (bsc#1269568) +Patch9: libssh2-CVE-2026-58050.patch +#PATCH-FIX-UPSTREAM CVE-2026-58051: Public key list is increased and does not zero-initialized new entries, which can cause an uninitialized pointer to be freed when a malformed response is sent by an SSH server (bsc#1269567) +Patch10: libssh2-CVE-2026-58051.patch + BuildRequires: cmake BuildRequires: pkgconfig BuildRequires: pkgconfig(libcrypto) ++++++ libssh2-CVE-2026-58050.patch ++++++ >From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001 From: Viktor Szakats <[email protected]> Date: Sun, 28 Jun 2026 02:12:52 +0200 Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit `libssh2_publickey_list_fetch()` Cap list size at 1024 elements. Reported-and-initial-patch-by: Mateusz Gierblinski Reported-and-initial-patch-by: Behzod Abdullayev Reported-by: Sharique Raza Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9 Closes #2128 --- src/publickey.c | 5 +++++ 1 file changed, 5 insertions(+) Index: libssh2-1.11.1/src/publickey.c =================================================================== --- libssh2-1.11.1.orig/src/publickey.c +++ libssh2-1.11.1/src/publickey.c @@ -1121,6 +1121,11 @@ libssh2_publickey_list_fetch(LIBSSH2_PUB } if(list[keys].num_attrs) { + if(list[keys].num_attrs > 1024) { + _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY, + "Too many publickey attributes"); + goto err_exit; + } list[keys].attrs = LIBSSH2_ALLOC(session, list[keys].num_attrs * ++++++ libssh2-CVE-2026-58051.patch ++++++ >From a9758da45a52bc8c630ec9493804d0c6ea30b24a Mon Sep 17 00:00:00 2001 From: Viktor Szakats <[email protected]> Date: Mon, 29 Jun 2026 19:12:21 +0200 Subject: [PATCH] publickey: fix potential arbitrary free in `libssh2_publickey_list_fetch()` (#2127) Due to uninitialized list entry. Reported-and-patch-by: Behzod Abdullayev Reported-by: Sharique Raza Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9 --- src/publickey.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/publickey.c b/src/publickey.c index b7f384310e..a0d3100005 100644 --- a/src/publickey.c +++ b/src/publickey.c @@ -905,6 +905,7 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey, goto err_exit; } list = newlist; + memset(&list[keys], 0, sizeof(list[keys])); } if(pkey->version == 1) { unsigned long comment_len; ++++++ libssh2-CVE-2026-66032.patch ++++++ >From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001 From: Will Cosgrove <[email protected]> Date: Thu, 2 Jul 2026 11:00:23 -0700 Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180) Set data to NULL after freeing it to avoid dangling pointer. fixes GHSA-px3w-7g75-hg7w. Credit: VladimirEliTokarev --- src/sftp.c | 1 + 1 file changed, 1 insertion(+) Index: libssh2-1.11.1/src/sftp.c =================================================================== --- libssh2-1.11.1.orig/src/sftp.c +++ libssh2-1.11.1/src/sftp.c @@ -1279,6 +1279,7 @@ sftp_open(LIBSSH2_SFTP *sftp, const char "got HANDLE FXOK")); LIBSSH2_FREE(session, data); + data = NULL; /* silly situation, but check for a HANDLE */ rc = sftp_packet_require(sftp, SSH_FXP_HANDLE, ++++++ libssh2-CVE-2026-66033.patch ++++++ >From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001 From: Viktor Szakats <[email protected]> Date: Thu, 23 Jul 2026 10:32:04 +0200 Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in `ssh2_cipher_crypt()` By applying two bounds checks to non-debug builds. Reported-by: Vladimir Eli Tokarev Fixes GHSA-c4f7-cvfc-33j7 Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 Closes #2401 --- src/openssl.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/openssl.c b/src/openssl.c index 6a38b55b91..31ef6db371 100644 --- a/src/openssl.c +++ b/src/openssl.c @@ -945,13 +945,15 @@ int ssh2_cipher_crypt(ssh2_cipher_ctx *ctx, SSH2_CIPHER_T(algo), int encrypt, const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0; /* size of AT, if present */ const int authenticationtag = IS_LAST(firstlast) ? authlen : 0; - /* length to encrypt */ - const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; + unsigned int cryptlen; /* length to encrypt */ (void)algo; - assert(blocksize <= sizeof(buf)); - assert(cryptlen >= 0); + if(blocksize > sizeof(buf) || + blocksize < (size_t)(aadlen + authenticationtag)) + return 1; + + cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; #if LIBSSH2_AES_GCM /* First block */ ++++++ libssh2-CVE-2026-66034.patch ++++++ >From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001 From: Viktor Szakats <[email protected]> Date: Sat, 4 Jul 2026 11:19:49 +0200 Subject: [PATCH] publickey: fix potential OOB read in `libssh2_publickey_list_fetch()` Reported-by: Vladimir Eli Tokarev Fixes GHSA-w6g9-cpfp-22gc Closes #2202 --- src/publickey.c | 7 +++++++ 1 file changed, 7 insertions(+) Index: libssh2-1.11.1/src/publickey.c =================================================================== --- libssh2-1.11.1.orig/src/publickey.c +++ libssh2-1.11.1/src/publickey.c @@ -988,6 +988,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUB } if(comment_len) { + if(pkey->listFetch_s + comment_len > + pkey->listFetch_data + pkey->listFetch_data_len) { + _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, + "ListFetch data too short"); + goto err_exit; + } + list[keys].num_attrs = 1; list[keys].attrs = LIBSSH2_ALLOC(session, ++++++ libssh2-CVE-2026-66035.patch ++++++ >From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001 From: Viktor Szakats <[email protected]> Date: Fri, 3 Jul 2026 18:22:55 +0200 Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt Reported-by: Vladimir Eli Tokarev Fixes GHSA-6c79-444r-wx26 Closes #2198 --- src/transport.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) Index: libssh2-1.11.1/src/transport.c =================================================================== --- libssh2-1.11.1.orig/src/transport.c +++ libssh2-1.11.1/src/transport.c @@ -242,6 +242,14 @@ fullpacket(LIBSSH2_SESSION * session, in unsigned char *decrypt_buffer; int blocksize = session->remote.crypt->blocksize; + if(p->total_num < mac_len + 4 + (size_t)blocksize) { + LIBSSH2_FREE(session, p->payload); + return LIBSSH2_ERROR_DECRYPT; + } + decrypt_size = (ssize_t)(p->total_num - mac_len - 4); + + first_block[0] = 0; + rc = decrypt(session, p->payload + 4, first_block, blocksize, FIRST_BLOCK); if(rc) { @@ -249,7 +257,6 @@ fullpacket(LIBSSH2_SESSION * session, in } /* we need buffer for decrypt */ - decrypt_size = p->total_num - mac_len - 4; decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size); if(!decrypt_buffer) { return LIBSSH2_ERROR_ALLOC;
