Source: libssh2 Version: 1.11.1-5 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for libssh2. CVE-2026-58050[0]: | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute | count from a publickey-subsystem response and uses it in the | allocation num_attrs * sizeof(libssh2_publickey_attribute) without | bounds checking, so on 32-bit platforms the multiplication overflows | to an undersized buffer. A malicious SSH server can then drive the | attribute-parsing loop to write past the allocation, causing a heap | buffer overflow in a connecting libssh2 client. CVE-2026-58051[1]: | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC | but does not zero-initialize new entries before parsing populates | them, so a parse failure reaching the cleanup path leaves | libssh2_publickey_list_free operating on an uninitialized entry. A | malicious SSH server offering the publickey subsystem can use a | malformed response to make cleanup free an uninitialized, attacker- | influenceable attrs pointer in a connecting libssh2 client. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-58050 https://www.cve.org/CVERecord?id=CVE-2026-58050 https://github.com/libssh2/libssh2/pull/2128 https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12 [1] https://security-tracker.debian.org/tracker/CVE-2026-58051 https://www.cve.org/CVERecord?id=CVE-2026-58051 https://github.com/libssh2/libssh2/pull/2127 https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a Please adjust the affected versions in the BTS as needed. Regards, Salvatore
