Hi Thorsten, On 10/20/26 07:29, Thorsten Alteholz wrote:
Hi Simon,On 17.10.26 03:54, Simon Quigley wrote:Feedback is welcome. If nothing showstopping comes up, I'll upload this and issue the DLA on Monday evening (October 19th, 2026).the package looks good. Though I wonder why you didn't backport all tests (e.g. CVE-2026-59850, CVE-2026-59848).? When there are two commits to fix a CVE (CVE-2026-59847) I would not combine them in one patch. But that is just a matter of taste. An explanation why the patch for CVE-2026-59846 is more extensive than the original commit might answer questions in advance.
Thanks for taking a look! Good point on the tests. I've now pulled in every regression test that 0.10 can actually build. CVE-2026-0968, CVE-2026-59843 and CVE-2026-59850 run as part of the unit tests the package already enables. For CVE-2026-59850, the upstream test lives in the sftp server torture harness, which 0.10 doesn't have, so my version calls channel_rcv_data() directly instead. CVE-2026-3731 and CVE-2026-59848 are trickier. Their tests are client tests, so I've included them, but bookworm doesn't build with CLIENT_TESTING, and the upstream harness starts sshd with -r, which OpenSSH 9.2 doesn't support. So I tested both by hand against a local sshd. An index past the advertised extensions gets rejected, and an SFTP reply for a request id the client never sent fails as an unknown request id, which is what we want. CVE-2026-0964, CVE-2026-59844 and CVE-2026-59845 don't have upstream tests. Fair enough on CVE-2026-59847. I've split it into two patches, one per upstream commit: the first adds the AES-GCM decrypt check and the second the encrypt check. And yes, I should have explained CVE-2026-59846. The patch is bigger than the 0.11 commit because 0.10 doesn't have ssh_check_username_syntax(), so I backported that helper and its call sites from 0.11.0 along with the fix. The helper isn't exported, so there's no ABI change. Unless anything else comes up, I'll upload 0.10.6-0+deb12u3 to bookworm-security in a few hours. Thanks again, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
