Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], Salvatore Bonaccorso <[email protected]>, Emmanuel Arias <[email protected]> Control: affects -1 + src:libssh2 User: [email protected] Usertags: pu
[ Reason ] Fix CVEs CVE-2026-66032 CVE-2026-66033 CVE-2026-66034 CVE-2026-66035 CVE-2026-58050 CVE-2026-58051 [ Impact ] Denial of service, heap corruption or information disclosure [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Backport of the packages 1.11.1-6 and 1.11.1-5 in unstable
diff -Nru libssh2-1.11.1/debian/changelog libssh2-1.11.1/debian/changelog --- libssh2-1.11.1/debian/changelog 2026-06-23 17:01:56.000000000 -0400 +++ libssh2-1.11.1/debian/changelog 2026-08-02 10:50:39.000000000 -0400 @@ -1,3 +1,10 @@ +libssh2 (1.11.1-1+deb13u2) trixie; urgency=medium + + * d/patches: Fix CVEs CVE-2026-66032 CVE-2026-66033 CVE-2026-66034 + CVE-2026-66035 CVE-2026-58050 CVE-2026-58051 (Backport from unstable) + + -- Nicolas Mora <[email protected]> Sun, 02 Aug 2026 10:50:39 -0400 + libssh2 (1.11.1-1+deb13u1) trixie-security; urgency=medium * CVE-2026-7598 (Closes: #1135647) diff -Nru libssh2-1.11.1/debian/patches/CVE-2026-58050.patch libssh2-1.11.1/debian/patches/CVE-2026-58050.patch --- libssh2-1.11.1/debian/patches/CVE-2026-58050.patch 1969-12-31 19:00:00.000000000 -0500 +++ libssh2-1.11.1/debian/patches/CVE-2026-58050.patch 2026-08-02 10:50:39.000000000 -0400 @@ -0,0 +1,34 @@ +From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Sun, 28 Jun 2026 02:12:52 +0200 +Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit + `libssh2_publickey_list_fetch()` + +Cap list size at 1024 elements. + +Reported-and-initial-patch-by: Mateusz Gierblinski +Reported-and-initial-patch-by: Behzod Abdullayev +Reported-by: Sharique Raza + +Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9 + +Closes #2128 +Forwarded: not-needed +--- + src/publickey.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -1121,6 +1121,11 @@ + } + + if(list[keys].num_attrs) { ++ if(list[keys].num_attrs > 1024) { ++ _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY, ++ "Too many publickey attributes"); ++ goto err_exit; ++ } + list[keys].attrs = + LIBSSH2_ALLOC(session, + list[keys].num_attrs * diff -Nru libssh2-1.11.1/debian/patches/CVE-2026-58051.patch libssh2-1.11.1/debian/patches/CVE-2026-58051.patch --- libssh2-1.11.1/debian/patches/CVE-2026-58051.patch 1969-12-31 19:00:00.000000000 -0500 +++ libssh2-1.11.1/debian/patches/CVE-2026-58051.patch 2026-08-02 10:50:39.000000000 -0400 @@ -0,0 +1,25 @@ +From 32092f0d310f4d769e5ed073ad5987f997f446dc Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Sun, 28 Jun 2026 02:13:32 +0200 +Subject: [PATCH] publickey: fix potential arbitrary free in + `libssh2_publickey_list_fetch()` + +Due to uninitialized list entry. + +Reported-and-patch-by: Behzod Abdullayev +Reported-by: Sharique Raza +Forwarded: not-needed +--- + src/publickey.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -972,6 +972,7 @@ + goto err_exit; + } + list = newlist; ++ memset(&list[keys], 0, sizeof(list[keys])); + } + if(pkey->version == 1) { + unsigned long comment_len; diff -Nru libssh2-1.11.1/debian/patches/CVE-2026-66032.patch libssh2-1.11.1/debian/patches/CVE-2026-66032.patch --- libssh2-1.11.1/debian/patches/CVE-2026-66032.patch 1969-12-31 19:00:00.000000000 -0500 +++ libssh2-1.11.1/debian/patches/CVE-2026-66032.patch 2026-08-02 10:44:29.000000000 -0400 @@ -0,0 +1,24 @@ +From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001 +From: Will Cosgrove <[email protected]> +Date: Thu, 2 Jul 2026 11:00:23 -0700 +Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180) + +Set data to NULL after freeing it to avoid dangling pointer. fixes +GHSA-px3w-7g75-hg7w. + +Credit: VladimirEliTokarev +Forwarded: not-needed +--- + src/sftp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -1279,6 +1279,7 @@ + "got HANDLE FXOK")); + + LIBSSH2_FREE(session, data); ++ data = NULL; + + /* silly situation, but check for a HANDLE */ + rc = sftp_packet_require(sftp, SSH_FXP_HANDLE, diff -Nru libssh2-1.11.1/debian/patches/CVE-2026-66033.patch libssh2-1.11.1/debian/patches/CVE-2026-66033.patch --- libssh2-1.11.1/debian/patches/CVE-2026-66033.patch 1969-12-31 19:00:00.000000000 -0500 +++ libssh2-1.11.1/debian/patches/CVE-2026-66033.patch 2026-08-02 10:44:33.000000000 -0400 @@ -0,0 +1,40 @@ +From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Thu, 23 Jul 2026 10:32:04 +0200 +Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in + `ssh2_cipher_crypt()` + +By applying two bounds checks to non-debug builds. + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-c4f7-cvfc-33j7 +Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 + +Closes #2401 +Forwarded: not-needed +--- + src/openssl.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/src/openssl.c ++++ b/src/openssl.c +@@ -1042,13 +1042,15 @@ + const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0; + /* size of AT, if present */ + const int authenticationtag = IS_LAST(firstlast) ? authlen : 0; +- /* length to encrypt */ +- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; ++ unsigned int cryptlen; /* length to encrypt */ + + (void)algo; + +- assert(blocksize <= sizeof(buf)); +- assert(cryptlen >= 0); ++ if(blocksize > sizeof(buf) || ++ blocksize < (size_t)(aadlen + authenticationtag)) ++ return 1; ++ ++ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; + + #if LIBSSH2_AES_GCM + /* First block */ diff -Nru libssh2-1.11.1/debian/patches/CVE-2026-66034.patch libssh2-1.11.1/debian/patches/CVE-2026-66034.patch --- libssh2-1.11.1/debian/patches/CVE-2026-66034.patch 1969-12-31 19:00:00.000000000 -0500 +++ libssh2-1.11.1/debian/patches/CVE-2026-66034.patch 2026-08-02 10:44:38.000000000 -0400 @@ -0,0 +1,31 @@ +From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Sat, 4 Jul 2026 11:19:49 +0200 +Subject: [PATCH] publickey: fix potential OOB read in + `libssh2_publickey_list_fetch()` + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-w6g9-cpfp-22gc + +Closes #2202 +Forwarded: not-needed +--- + src/publickey.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -988,6 +988,13 @@ + } + + if(comment_len) { ++ if(pkey->listFetch_s + comment_len > ++ pkey->listFetch_data + pkey->listFetch_data_len) { ++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "ListFetch data too short"); ++ goto err_exit; ++ } ++ + list[keys].num_attrs = 1; + list[keys].attrs = + LIBSSH2_ALLOC(session, diff -Nru libssh2-1.11.1/debian/patches/CVE-2026-66035.patch libssh2-1.11.1/debian/patches/CVE-2026-66035.patch --- libssh2-1.11.1/debian/patches/CVE-2026-66035.patch 1969-12-31 19:00:00.000000000 -0500 +++ libssh2-1.11.1/debian/patches/CVE-2026-66035.patch 2026-08-02 10:44:41.000000000 -0400 @@ -0,0 +1,37 @@ +From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Fri, 3 Jul 2026 18:22:55 +0200 +Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-6c79-444r-wx26 + +Closes #2198 +Forwarded: not-needed +--- + src/transport.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/src/transport.c ++++ b/src/transport.c +@@ -242,6 +242,12 @@ + unsigned char *decrypt_buffer; + int blocksize = session->remote.crypt->blocksize; + ++ if(p->total_num < mac_len + 4 + (size_t)blocksize) { ++ LIBSSH2_FREE(session, p->payload); ++ return LIBSSH2_ERROR_DECRYPT; ++ } ++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4); ++ + rc = decrypt(session, p->payload + 4, + first_block, blocksize, FIRST_BLOCK); + if(rc) { +@@ -249,7 +255,6 @@ + } + + /* we need buffer for decrypt */ +- decrypt_size = p->total_num - mac_len - 4; + decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size); + if(!decrypt_buffer) { + return LIBSSH2_ERROR_ALLOC; diff -Nru libssh2-1.11.1/debian/patches/series libssh2-1.11.1/debian/patches/series --- libssh2-1.11.1/debian/patches/series 2026-06-23 17:01:56.000000000 -0400 +++ libssh2-1.11.1/debian/patches/series 2026-08-02 10:50:39.000000000 -0400 @@ -11,3 +11,9 @@ CVE-2026-55199.patch CVE-2026-55200.patch libssh-unconst-backport.patch +CVE-2026-66032.patch +CVE-2026-66033.patch +CVE-2026-66034.patch +CVE-2026-66035.patch +CVE-2026-58050.patch +CVE-2026-58051.patch
