David Runge pushed to branch main at Arch Linux / Packaging / Packages / libssh2
Commits: 8e755082 by David Runge at 2026-07-11T01:09:59+02:00 Apply backported fix for CVE-2026-58050 Related-to: https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12 Signed-off-by: David Runge <[email protected]> - - - - - 47e2c83d by David Runge at 2026-07-11T01:16:21+02:00 Cherry-pick commit fixing CVE-2026-58051 Related-to: https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a Signed-off-by: David Runge <[email protected]> - - - - - 7b2bbd50 by David Runge at 2026-07-11T01:20:04+02:00 upgpkg: 1.11.1-6 Rebuild to apply fixes for CVE-2026-58050 and CVE-2026-58051. - - - - - 4 changed files: - .SRCINFO - PKGBUILD - REUSE.toml - + libssh2-1.11.1-CVE-2026-58050.patch Changes: ===================================== .SRCINFO ===================================== @@ -1,7 +1,7 @@ pkgbase = libssh2 pkgdesc = A library implementing the SSH2 protocol as defined by Internet Drafts pkgver = 1.11.1 - pkgrel = 5 + pkgrel = 6 url = https://www.libssh2.org/ arch = x86_64 license = BSD-3-Clause @@ -13,9 +13,11 @@ pkgbase = libssh2 source = git+https://github.com/libssh2/libssh2.git?signed#tag=libssh2-1.11.1 source = libssh2-1.11.1-CVE-2025-15661.patch source = libssh2-1.11.1-CVE-2026-55200.patch + source = libssh2-1.11.1-CVE-2026-58050.patch validpgpkeys = 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2 b2sums = e09704f04dea54a1583e295002f27de7a40a97fcb05ab12b650735af78be177ddf211ebb2c78098b1b39800ea40b95a63364b50773f54150dff171d0af03177b b2sums = bb012adcced6e85c4e5e987082ccdae893fa10f17862ac49037b1f0232e16ebde3317235bc2ee7d6054678d2c927077c3ab0ce6d35990671d2c3314d4d9ae66f b2sums = 743feb7c180288de94649bb1a20b1b2761151c6eaa271d4b6bf145bfceb30684803dfe3c1f6314714381fdce784c5a426c5adc3d58ee49ab1fc0d8f1bc66abfd + b2sums = d552a28093841db332a23d2aad5f1f305ef3659e3d9de9cf5b2888a1f6d86a4418830aaa51e91e0c72086eb056806cbb0cfe9244ddb88c0b68b11612aa77d9de pkgname = libssh2 ===================================== PKGBUILD ===================================== @@ -8,7 +8,7 @@ pkgname=libssh2 pkgver=1.11.1 -pkgrel=5 +pkgrel=6 pkgdesc="A library implementing the SSH2 protocol as defined by Internet Drafts" url="https://www.libssh2.org/"; arch=('x86_64') @@ -20,10 +20,12 @@ source=( "git+https://github.com/libssh2/libssh2.git?signed#tag=${pkgname}-${pkgver}"; $pkgname-1.11.1-CVE-2025-15661.patch $pkgname-1.11.1-CVE-2026-55200.patch + $pkgname-1.11.1-CVE-2026-58050.patch ) b2sums=('e09704f04dea54a1583e295002f27de7a40a97fcb05ab12b650735af78be177ddf211ebb2c78098b1b39800ea40b95a63364b50773f54150dff171d0af03177b' 'bb012adcced6e85c4e5e987082ccdae893fa10f17862ac49037b1f0232e16ebde3317235bc2ee7d6054678d2c927077c3ab0ce6d35990671d2c3314d4d9ae66f' - '743feb7c180288de94649bb1a20b1b2761151c6eaa271d4b6bf145bfceb30684803dfe3c1f6314714381fdce784c5a426c5adc3d58ee49ab1fc0d8f1bc66abfd') + '743feb7c180288de94649bb1a20b1b2761151c6eaa271d4b6bf145bfceb30684803dfe3c1f6314714381fdce784c5a426c5adc3d58ee49ab1fc0d8f1bc66abfd' + 'd552a28093841db332a23d2aad5f1f305ef3659e3d9de9cf5b2888a1f6d86a4418830aaa51e91e0c72086eb056806cbb0cfe9244ddb88c0b68b11612aa77d9de') validpgpkeys=('27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2') # Daniel Stenberg prepare() { @@ -32,6 +34,8 @@ prepare() { git cherry-pick -n 256d04b60d80bf1190e96b0ad1e91b2174d744b1 # CVE-2026-7598 git cherry-pick -n 17626857d20b3c9a1addfa45979dadcee1cd84a4 # CVE-2026-55199 patch -Np1 -i ../$pkgname-1.11.1-CVE-2026-55200.patch # CVE-2026-55200 + git cherry-pick -n a9758da45a52bc8c630ec9493804d0c6ea30b24a # CVE-2026-58051 + patch -Np1 -i ../$pkgname-1.11.1-CVE-2026-58050.patch # CVE-2026-58050 # The "_DEV" suffix is only removed from `LIBSSH2_VERSION` for dist tarballs, so we do it here. sed 's/_DEV//' --in-place include/libssh2.h autoreconf -fiv ===================================== REUSE.toml ===================================== @@ -25,6 +25,7 @@ SPDX-License-Identifier = "0BSD" path = [ "libssh2-1.11.1-CVE-2025-15661.patch", "libssh2-1.11.1-CVE-2026-55200.patch", + "libssh2-1.11.1-CVE-2026-58050.patch", ] SPDX-FileCopyrightText = "2009-2026 Daniel Stenberg and libssh2 contributors" SPDX-License-Identifier = "BSD-3-Clause" ===================================== libssh2-1.11.1-CVE-2026-58050.patch ===================================== @@ -0,0 +1,35 @@ +From c92bc2a919a357a575e52443f50d76d58900629e Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Sun, 28 Jun 2026 02:12:52 +0200 +Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit + `libssh2_publickey_list_fetch()` + +Cap list size at 1024 elements. + +Reported-and-initial-patch-by: Mateusz Gierblinski +Reported-and-initial-patch-by: Behzod Abdullayev +Reported-by: Sharique Raza + +Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9 + +Closes #2128 +--- + src/publickey.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/publickey.c b/src/publickey.c +index 9c9fa618..a332c729 100644 +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -1114,6 +1114,11 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys, + } + + if(list[keys].num_attrs) { ++ if(list[keys].num_attrs > 1024) { ++ _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY, ++ "Too many publickey attributes"); ++ goto err_exit; ++ } + list[keys].attrs = + LIBSSH2_ALLOC(session, + list[keys].num_attrs * View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/libssh2/-/compare/fe63f13815d1459ea5bc6c1c9e49a0da5cd511d2...7b2bbd502875f6cbf03d41bb2ec26ea5d5b0e985 -- View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/libssh2/-/compare/fe63f13815d1459ea5bc6c1c9e49a0da5cd511d2...7b2bbd502875f6cbf03d41bb2ec26ea5d5b0e985 You're receiving this email because of your account on gitlab.archlinux.org. Manage all notifications: https://gitlab.archlinux.org/-/profile/notifications | Help: https://gitlab.archlinux.org/help
