Hi all, Picked up libssh for bookworm - it's been sitting on dla-needed.txt since late July with no claim note, so flagging here per the wiki's guidance rather than editing the file myself.
Bookworm ships 0.10.6-0+deb12u2, exposed to 15 CVEs already fixed upstream across the 0.11.4/0.11.5/0.12.0/0.12.1 releases. All 15 are backported, built, and test-verified against the real bookworm source (both the OpenSSL and gcrypt build variants, full ctest suite passing on each). MR here: https://salsa.debian.org/debian/libssh/-/merge_requests/10 A couple of notes on the less mechanical parts, in case they're useful for review: - Two of the fifteen (CVE-2026-15370, CVE-2026-59849) don't actually apply to 0.10.6 - the vulnerable code in both cases was introduced by features added after this version (an SFTP longname helper, a certificate-based auto-auth state machine). Documented in the changelog rather than silently skipped. - CVE-2026-59846's own advisory only widens an existing character blocklist, but that underlying function doesn't exist in 0.10.6 at all - it was added upstream literally a few days after this exact release shipped. Had to port the whole missing function plus its real call sites, not just the advisory's narrow diff. - CVE-2026-59848 keeps a public function's original signature rather than following upstream's own wider refactor across 20 call sites, while still closing the actual vulnerability - reasoning is in that patch's own header. Happy to adjust anything the maintainers would prefer done differently. Ivo
