--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:libssh
User: [email protected]
Usertags: pu
[ Reason ]
This update fixes various CVEs of minor severity, tagged <no-dsa> by
the Security Team.
[ Impact ]
If this isn't approved, various (minor) client-side security issues will
be left unfixed.
[ Tests ]
Build tests, autopkgtests, rdeps autopkgtest (thanks to debusine, see [1]).
Verified that the cryptsetup/amd64 failure is not a regression (fails with
deb12u1 too), probably due to lack of permissions on the runner.
Some manual tests as well with libssh rdeps.
[ Risks ]
Risk is small as the patches were easy to backport, and due to the tests.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Other ]
I have already uploaded the package to oldstable-new.
Cheers,
Emilio
diff -Nru libssh-0.10.6/debian/changelog libssh-0.10.6/debian/changelog
--- libssh-0.10.6/debian/changelog 2023-12-25 11:15:40.000000000 +0100
+++ libssh-0.10.6/debian/changelog 2025-11-26 10:29:30.000000000 +0100
@@ -1,3 +1,23 @@
+libssh (0.10.6-0+deb12u2) bookworm; urgency=medium
+
+ [ Martin Pitt ]
+ * stable-security → bookworm-security
+ * Backport security patches from 0.11.2.
+ - CVE-2025-4877: Write beyond bounds in binary to base64 conversion
functions
+ - CVE-2025-4878: Use of uninitialized variable in privatekey_from_file()
+ - CVE-2025-5318: Likely read beyond bounds in sftp server handle
management
+ - CVE-2025-5351: Double free in functions exporting keys
+ - CVE-2025-5372: ssh_kdf() returns a success code on certain failures
+ - CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL
backend
+
https://www.libssh.org/2025/06/24/libssh-0-11-2-security-and-bugfix-release/
+ (Closes: #1108407)
+
+ [ Emilio Pozuelo Monfort ]
+ * Add patch for CVE-2025-8114
+ * Add patches for CVE-2025-8277
+
+ -- Emilio Pozuelo Monfort <[email protected]> Wed, 26 Nov 2025 10:29:30 +0100
+
libssh (0.10.6-0+deb12u1) bookworm-security; urgency=medium
* New upstream security release:
diff -Nru
libssh-0.10.6/debian/patches/0003-CVE-2025-4877-base64-Prevent-integer-overflow-and-po.patch
libssh-0.10.6/debian/patches/0003-CVE-2025-4877-base64-Prevent-integer-overflow-and-po.patch
---
libssh-0.10.6/debian/patches/0003-CVE-2025-4877-base64-Prevent-integer-overflow-and-po.patch
1970-01-01 01:00:00.000000000 +0100
+++
libssh-0.10.6/debian/patches/0003-CVE-2025-4877-base64-Prevent-integer-overflow-and-po.patch
2025-11-26 10:29:30.000000000 +0100
@@ -0,0 +1,54 @@
+From 1f2119c3ef2ee83d663a8eaec2887b4a7724a4a7 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Tue, 15 Apr 2025 11:41:24 +0200
+Subject: [PATCH 3/8] CVE-2025-4877 base64: Prevent integer overflow and
+ potential OOB
+
+Set maximum input to 256MB to have safe margin to the 1GB trigger point
+for 32b arch.
+
+The OOB should not be reachable by any internal code paths as most of
+the buffers and strings we use as input for this operation already have
+similar limit and none really allows this much of data.
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+(cherry picked from commit 00f09acbec55962839fc7837ef14c56fb8fbaf72)
+---
+ src/base64.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/base64.c b/src/base64.c
+index 4148f49c..f42e0e80 100644
+--- a/src/base64.c
++++ b/src/base64.c
+@@ -29,6 +29,9 @@
+ #include "libssh/priv.h"
+ #include "libssh/buffer.h"
+
++/* Do not allow encoding more than 256MB of data */
++#define BASE64_MAX_INPUT_LEN 256 * 1024 * 1024
++
+ static
+ const uint8_t alphabet[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+ "abcdefghijklmnopqrstuvwxyz"
+@@ -274,7 +277,15 @@ uint8_t *bin_to_base64(const uint8_t *source, size_t len)
+ {
+ uint8_t *base64 = NULL;
+ uint8_t *ptr = NULL;
+- size_t flen = len + (3 - (len % 3)); /* round to upper 3 multiple */
++ size_t flen = 0;
++
++ /* Set the artificial upper limit for the input. Otherwise on 32b arch,
the
++ * following line could overflow for sizes larger than SIZE_MAX / 4 */
++ if (len > BASE64_MAX_INPUT_LEN) {
++ return NULL;
++ }
++
++ flen = len + (3 - (len % 3)); /* round to upper 3 multiple */
+ flen = (4 * flen) / 3 + 1;
+
+ base64 = malloc(flen);
+--
+2.50.0
+
diff -Nru
libssh-0.10.6/debian/patches/0004-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
libssh-0.10.6/debian/patches/0004-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
---
libssh-0.10.6/debian/patches/0004-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
1970-01-01 01:00:00.000000000 +0100
+++
libssh-0.10.6/debian/patches/0004-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
2025-11-26 10:29:30.000000000 +0100
@@ -0,0 +1,29 @@
+From dab8d2b63397046c4d1f5aa3f18a7c0f162a3311 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Tue, 22 Apr 2025 21:18:44 +0200
+Subject: [PATCH 4/8] CVE-2025-5318: sftpserver: Fix possible buffer overrun
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+
+(cherry-picked from commit 5f4ffda88770f95482f)
+---
+ src/sftpserver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sftpserver.c b/src/sftpserver.c
+index 9117f155..b3349e16 100644
+--- a/src/sftpserver.c
++++ b/src/sftpserver.c
+@@ -538,7 +538,7 @@ void *sftp_handle(sftp_session sftp, ssh_string handle){
+
+ memcpy(&val, ssh_string_data(handle), sizeof(uint32_t));
+
+- if (val > SFTP_HANDLES) {
++ if (val >= SFTP_HANDLES) {
+ return NULL;
+ }
+
+--
+2.50.0
+
diff -Nru
libssh-0.10.6/debian/patches/0005-CVE-2025-4878-legacy-Properly-check-return-value-to-.patch
libssh-0.10.6/debian/patches/0005-CVE-2025-4878-legacy-Properly-check-return-value-to-.patch
---
libssh-0.10.6/debian/patches/0005-CVE-2025-4878-legacy-Properly-check-return-value-to-.patch
1970-01-01 01:00:00.000000000 +0100
+++
libssh-0.10.6/debian/patches/0005-CVE-2025-4878-legacy-Properly-check-return-value-to-.patch
2025-11-26 10:29:30.000000000 +0100
@@ -0,0 +1,30 @@
+From efa3d8ce232a21531a402c341e8ecdb0c943dbee Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Mon, 28 Apr 2025 11:04:55 +0200
+Subject: [PATCH 5/8] CVE-2025-4878 legacy: Properly check return value to
+ avoid NULL pointer dereference
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+
+(cherry-picked from commit b35ee876adc92a208)
+---
+ src/legacy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/legacy.c b/src/legacy.c
+index 7b165dbe..c853cb38 100644
+--- a/src/legacy.c
++++ b/src/legacy.c
+@@ -451,7 +451,7 @@ ssh_private_key privatekey_from_file(ssh_session session,
+ auth_fn,
+ auth_data,
+ &key);
+- if (rc == SSH_ERROR) {
++ if (rc != SSH_OK) {
+ return NULL;
+ }
+
+--
+2.50.0
+
diff -Nru
libssh-0.10.6/debian/patches/0006-CVE-2025-5351-pki_crypto-Avoid-double-free-on-low-me.patch
libssh-0.10.6/debian/patches/0006-CVE-2025-5351-pki_crypto-Avoid-double-free-on-low-me.patch
---
libssh-0.10.6/debian/patches/0006-CVE-2025-5351-pki_crypto-Avoid-double-free-on-low-me.patch
1970-01-01 01:00:00.000000000 +0100
+++
libssh-0.10.6/debian/patches/0006-CVE-2025-5351-pki_crypto-Avoid-double-free-on-low-me.patch
2025-11-26 10:29:30.000000000 +0100
@@ -0,0 +1,37 @@
+From 2f7a6898497a23deae301f34611e8a6e24efa07a Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Tue, 6 May 2025 22:43:31 +0200
+Subject: [PATCH 6/8] CVE-2025-5351 pki_crypto: Avoid double-free on low-memory
+ conditions
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+
+(cherry-picked from commit 6ddb730a273389838)
+---
+ src/pki_crypto.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/pki_crypto.c b/src/pki_crypto.c
+index 5b0d7ded..aec49544 100644
+--- a/src/pki_crypto.c
++++ b/src/pki_crypto.c
+@@ -2023,6 +2023,7 @@ ssh_string pki_publickey_to_blob(const ssh_key key)
+ bignum_safe_free(bn);
+ bignum_safe_free(be);
+ OSSL_PARAM_free(params);
++ params = NULL;
+ #endif /* OPENSSL_VERSION_NUMBER */
+ break;
+ }
+@@ -2143,6 +2144,7 @@ ssh_string pki_publickey_to_blob(const ssh_key key)
+ */
+ #if 0
+ OSSL_PARAM_free(params);
++ params = NULL;
+ #endif /* OPENSSL_VERSION_NUMBER */
+
+ if (key->type == SSH_KEYTYPE_SK_ECDSA &&
+--
+2.50.0
+
diff -Nru
libssh-0.10.6/debian/patches/0007-CVE-2025-5987-libcrypto-Correctly-detect-failures-of.patch
libssh-0.10.6/debian/patches/0007-CVE-2025-5987-libcrypto-Correctly-detect-failures-of.patch
---
libssh-0.10.6/debian/patches/0007-CVE-2025-5987-libcrypto-Correctly-detect-failures-of.patch
1970-01-01 01:00:00.000000000 +0100
+++
libssh-0.10.6/debian/patches/0007-CVE-2025-5987-libcrypto-Correctly-detect-failures-of.patch
2025-11-26 10:29:30.000000000 +0100
@@ -0,0 +1,33 @@
+From f41bc133e824faf0fa8b71a1e74e4c9cbe8b543a Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Tue, 6 May 2025 22:51:41 +0200
+Subject: [PATCH 7/8] CVE-2025-5987 libcrypto: Correctly detect failures of
+ chacha initialization
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+
+(cherry-picked from commit 90b4845e0c98574bb)
+---
+ src/libcrypto.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/libcrypto.c b/src/libcrypto.c
+index 4f945d90..911b3630 100644
+--- a/src/libcrypto.c
++++ b/src/libcrypto.c
+@@ -777,9 +777,9 @@ chacha20_poly1305_set_key(struct ssh_cipher_struct *cipher,
+ SSH_LOG(SSH_LOG_WARNING, "EVP_CIPHER_CTX_new failed");
+ goto out;
+ }
+- ret = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL,
++ rv = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL,
+ u8key + CHACHA20_KEYLEN, NULL);
+- if (ret != 1) {
++ if (rv != 1) {
+ SSH_LOG(SSH_LOG_WARNING, "EVP_CipherInit failed");
+ goto out;
+ }
+--
+2.50.0
+
diff -Nru
libssh-0.10.6/debian/patches/0008-CVE-2025-5372-libgcrypto-Simplify-error-checking-and.patch
libssh-0.10.6/debian/patches/0008-CVE-2025-5372-libgcrypto-Simplify-error-checking-and.patch
---
libssh-0.10.6/debian/patches/0008-CVE-2025-5372-libgcrypto-Simplify-error-checking-and.patch
1970-01-01 01:00:00.000000000 +0100
+++
libssh-0.10.6/debian/patches/0008-CVE-2025-5372-libgcrypto-Simplify-error-checking-and.patch
2025-11-26 10:29:30.000000000 +0100
@@ -0,0 +1,148 @@
+From 1808f0e65e2f672046470db2c1e682999360f92c Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Wed, 14 May 2025 14:07:58 +0200
+Subject: [PATCH 8/8] CVE-2025-5372 libgcrypto: Simplify error checking and
+ handling of return codes in ssh_kdf()
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+
+(cherry-picked from commit a9d8a3d44829cf9182b)
+---
+ src/libcrypto.c | 62 ++++++++++++++++++++++---------------------------
+ 1 file changed, 28 insertions(+), 34 deletions(-)
+
+diff --git a/src/libcrypto.c b/src/libcrypto.c
+index 911b3630..69a850de 100644
+--- a/src/libcrypto.c
++++ b/src/libcrypto.c
+@@ -163,7 +163,7 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
+ uint8_t key_type, unsigned char *output,
+ size_t requested_len)
+ {
+- int rc = -1;
++ int ret = SSH_ERROR, rv;
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L
+ EVP_KDF_CTX *ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF);
+ #else
+@@ -185,81 +185,75 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
+ }
+
+ #if OPENSSL_VERSION_NUMBER < 0x30000000L
+- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
++ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
+ sshkdf_digest_to_md(crypto->digest_type));
+- if (rc != 1) {
++ if (rv != 1) {
+ goto out;
+ }
+- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, key_len);
+- if (rc != 1) {
++ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, key_len);
++ if (rv != 1) {
+ goto out;
+ }
+- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
++ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
+ crypto->secret_hash, crypto->digest_len);
+- if (rc != 1) {
++ if (rv != 1) {
+ goto out;
+ }
+- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, key_type);
+- if (rc != 1) {
++ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, key_type);
++ if (rv != 1) {
+ goto out;
+ }
+- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
++ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
+ crypto->session_id, crypto->session_id_len);
+- if (rc != 1) {
++ if (rv != 1) {
+ goto out;
+ }
+- rc = EVP_KDF_derive(ctx, output, requested_len);
+- if (rc != 1) {
++ rv = EVP_KDF_derive(ctx, output, requested_len);
++ if (rv != 1) {
+ goto out;
+ }
+ #else
+- rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
++ rv = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
+ md, strlen(md));
+- if (rc != 1) {
+- rc = -1;
++ if (rv != 1) {
+ goto out;
+ }
+- rc = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
++ rv = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
+ key, key_len);
+- if (rc != 1) {
+- rc = -1;
++ if (rv != 1) {
+ goto out;
+ }
+- rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
++ rv = OSSL_PARAM_BLD_push_octet_string(param_bld,
+ OSSL_KDF_PARAM_SSHKDF_XCGHASH,
+ crypto->secret_hash,
+ crypto->digest_len);
+- if (rc != 1) {
+- rc = -1;
++ if (rv != 1) {
+ goto out;
+ }
+- rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
++ rv = OSSL_PARAM_BLD_push_octet_string(param_bld,
+ OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
+ crypto->session_id,
+ crypto->session_id_len);
+- if (rc != 1) {
+- rc = -1;
++ if (rv != 1) {
+ goto out;
+ }
+- rc = OSSL_PARAM_BLD_push_utf8_string(param_bld,
OSSL_KDF_PARAM_SSHKDF_TYPE,
++ rv = OSSL_PARAM_BLD_push_utf8_string(param_bld,
OSSL_KDF_PARAM_SSHKDF_TYPE,
+ (const char*)&key_type, 1);
+- if (rc != 1) {
+- rc = -1;
++ if (rv != 1) {
+ goto out;
+ }
+
+ params = OSSL_PARAM_BLD_to_param(param_bld);
+ if (params == NULL) {
+- rc = -1;
+ goto out;
+ }
+
+- rc = EVP_KDF_derive(ctx, output, requested_len, params);
+- if (rc != 1) {
+- rc = -1;
++ rv = EVP_KDF_derive(ctx, output, requested_len, params);
++ if (rv != 1) {
+ goto out;
+ }
+ #endif /* OPENSSL_VERSION_NUMBER */
++ ret = SSH_OK;
+
+ out:
+ #if OPENSSL_VERSION_NUMBER >= 0x30000000L
+@@ -267,8 +261,8 @@ out:
+ OSSL_PARAM_free(params);
+ #endif
+ EVP_KDF_CTX_free(ctx);
+- if (rc < 0) {
+- return rc;
++ if (ret < 0) {
++ return ret;
+ }
+ return 0;
+ }
+--
+2.50.0
+
diff -Nru libssh-0.10.6/debian/patches/CVE-2025-8114.patch
libssh-0.10.6/debian/patches/CVE-2025-8114.patch
--- libssh-0.10.6/debian/patches/CVE-2025-8114.patch 1970-01-01
01:00:00.000000000 +0100
+++ libssh-0.10.6/debian/patches/CVE-2025-8114.patch 2025-11-26
10:29:30.000000000 +0100
@@ -0,0 +1,32 @@
+From 65f363c9e3a22b90af7f74b5c439a133b1047379 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <[email protected]>
+Date: Wed, 6 Aug 2025 15:17:59 +0200
+Subject: CVE-2025-8114: Fix NULL pointer dereference after allocation failure
+
+--- libssh-0.11.2.orig/src/kex.c
++++ libssh-0.11.2/src/kex.c
+@@ -1487,6 +1487,8 @@ int ssh_make_sessionid(ssh_session sessi
+ ssh_log_hexdump("hash buffer", ssh_buffer_get(buf),
ssh_buffer_get_len(buf));
+ #endif
+
++ /* Set rc for the following switch statement in case we goto error. */
++ rc = SSH_ERROR;
+ switch (session->next_crypto->kex_type) {
+ case SSH_KEX_DH_GROUP1_SHA1:
+ case SSH_KEX_DH_GROUP14_SHA1:
+@@ -1546,6 +1548,7 @@ int ssh_make_sessionid(ssh_session sessi
+ session->next_crypto->secret_hash);
+ break;
+ }
++
+ /* During the first kex, secret hash and session ID are equal. However,
after
+ * a key re-exchange, a new secret hash is calculated. This hash will not
replace
+ * but complement existing session id.
+@@ -1554,6 +1557,7 @@ int ssh_make_sessionid(ssh_session sessi
+ session->next_crypto->session_id =
malloc(session->next_crypto->digest_len);
+ if (session->next_crypto->session_id == NULL) {
+ ssh_set_error_oom(session);
++ rc = SSH_ERROR;
+ goto error;
+ }
+ memcpy(session->next_crypto->session_id,
session->next_crypto->secret_hash,
diff -Nru libssh-0.10.6/debian/patches/CVE-2025-8277-1.patch
libssh-0.10.6/debian/patches/CVE-2025-8277-1.patch
--- libssh-0.10.6/debian/patches/CVE-2025-8277-1.patch 1970-01-01
01:00:00.000000000 +0100
+++ libssh-0.10.6/debian/patches/CVE-2025-8277-1.patch 2025-11-26
10:29:30.000000000 +0100
@@ -0,0 +1,36 @@
+From 87db2659ec608a977a63eea529f17b9168388d73 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Tue, 5 Aug 2025 18:42:31 +0200
+Subject: CVE-2025-8277: packet: Adjust packet filter to work when DH-GEX is
+ guessed wrongly
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+(cherry picked from commit 4310a696f2d632c6742678077d703d9b9ff3bc0e)
+---
+ src/packet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/packet.c b/src/packet.c
+index f15aa2ad5..f54b3158d 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -294,6 +294,7 @@ static enum ssh_packet_filter_result_e
ssh_packet_incoming_filter(ssh_session se
+ * or session_state == SSH_SESSION_STATE_INITIAL_KEX
+ * - dh_handshake_state == DH_STATE_INIT
+ * or dh_handshake_state == DH_STATE_INIT_SENT (re-exchange)
++ * or dh_handshake_state == DH_STATE_REQUEST_SENT (dh-gex)
+ * or dh_handshake_state == DH_STATE_FINISHED (re-exchange)
+ *
+ * Transitions:
+@@ -313,6 +314,7 @@ static enum ssh_packet_filter_result_e
ssh_packet_incoming_filter(ssh_session se
+
+ if ((session->dh_handshake_state != DH_STATE_INIT) &&
+ (session->dh_handshake_state != DH_STATE_INIT_SENT) &&
++ (session->dh_handshake_state != DH_STATE_REQUEST_SENT) &&
+ (session->dh_handshake_state != DH_STATE_FINISHED))
+ {
+ rc = SSH_PACKET_DENIED;
+--
+cgit v1.2.3
+
diff -Nru libssh-0.10.6/debian/patches/CVE-2025-8277-2.patch
libssh-0.10.6/debian/patches/CVE-2025-8277-2.patch
--- libssh-0.10.6/debian/patches/CVE-2025-8277-2.patch 1970-01-01
01:00:00.000000000 +0100
+++ libssh-0.10.6/debian/patches/CVE-2025-8277-2.patch 2025-11-26
10:29:30.000000000 +0100
@@ -0,0 +1,108 @@
+From 266174a6d36687b65cf90174f06af90b8b27c65f Mon Sep 17 00:00:00 2001
+From: Francesco Rollo <[email protected]>
+Date: Thu, 24 Jul 2025 16:30:07 +0300
+Subject: CVE-2025-8277: Fix memory leak of unused ephemeral key pair after
+ client's wrong KEX guess
+
+Signed-off-by: Francesco Rollo <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+(cherry picked from commit ccff22d3787c1355b3f0dcd09fe54d90acc55bf1)
+---
+ src/dh_crypto.c | 5 +++++
+ src/dh_key.c | 5 +++++
+ src/ecdh_crypto.c | 11 +++++++++++
+ src/ecdh_gcrypt.c | 6 ++++++
+ src/ecdh_mbedcrypto.c | 6 ++++++
+ 5 files changed, 33 insertions(+)
+
+diff --git a/src/dh_crypto.c b/src/dh_crypto.c
+index 4dd9b507e..cedfbc81a 100644
+--- a/src/dh_crypto.c
++++ b/src/dh_crypto.c
+@@ -407,6 +407,11 @@ int ssh_dh_init_common(struct ssh_crypto_struct *crypto)
+ struct dh_ctx *ctx;
+ int rc;
+
++ /* Cleanup any previously allocated dh_ctx */
++ if (crypto->dh_ctx != NULL) {
++ ssh_dh_cleanup(crypto);
++ }
++
+ ctx = calloc(1, sizeof(*ctx));
+ if (ctx == NULL) {
+ return SSH_ERROR;
+diff --git a/src/dh_key.c b/src/dh_key.c
+index 20d24a316..d9743cebd 100644
+--- a/src/dh_key.c
++++ b/src/dh_key.c
+@@ -237,6 +237,11 @@ int ssh_dh_init_common(struct ssh_crypto_struct *crypto)
+ struct dh_ctx *ctx = NULL;
+ int rc;
+
++ /* Cleanup any previously allocated dh_ctx */
++ if (crypto->dh_ctx != NULL) {
++ ssh_dh_cleanup(crypto);
++ }
++
+ ctx = calloc(1, sizeof(*ctx));
+ if (ctx == NULL) {
+ return SSH_ERROR;
+diff --git a/src/ecdh_crypto.c b/src/ecdh_crypto.c
+index 57c3dc893..a286804f4 100644
+--- a/src/ecdh_crypto.c
++++ b/src/ecdh_crypto.c
+@@ -191,6 +191,17 @@ static ssh_string ssh_ecdh_generate(ssh_session session)
+ SSH_STRING_FREE(client_pubkey);
+ return SSH_ERROR;
+ }
++
++ /* Free any previously allocated privkey */
++ if (session->next_crypto->ecdh_privkey != NULL) {
++#if 1 //#if OPENSSL_VERSION_NUMBER < 0x30000000L
++ EC_KEY_free(session->next_crypto->ecdh_privkey);
++#else
++ EVP_PKEY_free(session->next_crypto->ecdh_privkey);
++#endif
++ session->next_crypto->ecdh_privkey = NULL;
++ }
++
+
+ session->next_crypto->ecdh_privkey = key;
+ session->next_crypto->ecdh_client_pubkey = client_pubkey;
+diff --git a/src/ecdh_gcrypt.c b/src/ecdh_gcrypt.c
+index a52ca84dd..8eabfe181 100644
+--- a/src/ecdh_gcrypt.c
++++ b/src/ecdh_gcrypt.c
+@@ -101,6 +101,12 @@ int ssh_client_ecdh_init(ssh_session session)
+ goto out;
+ }
+
++ /* Free any previously allocated privkey */
++ if (session->next_crypto->ecdh_privkey != NULL) {
++ gcry_sexp_release(session->next_crypto->ecdh_privkey);
++ session->next_crypto->ecdh_privkey = NULL;
++ }
++
+ session->next_crypto->ecdh_privkey = key;
+ key = NULL;
+ session->next_crypto->ecdh_client_pubkey = client_pubkey;
+diff --git a/src/ecdh_mbedcrypto.c b/src/ecdh_mbedcrypto.c
+index 1d9c8f366..d31bfcc7a 100644
+--- a/src/ecdh_mbedcrypto.c
++++ b/src/ecdh_mbedcrypto.c
+@@ -70,6 +70,12 @@ int ssh_client_ecdh_init(ssh_session session)
+ return SSH_ERROR;
+ }
+
++ /* Free any previously allocated privkey */
++ if (session->next_crypto->ecdh_privkey != NULL) {
++ mbedtls_ecp_keypair_free(session->next_crypto->ecdh_privkey);
++ SAFE_FREE(session->next_crypto->ecdh_privkey);
++ }
++
+ session->next_crypto->ecdh_privkey = malloc(sizeof(mbedtls_ecp_keypair));
+ if (session->next_crypto->ecdh_privkey == NULL) {
+ return SSH_ERROR;
+--
+cgit v1.2.3
+
diff -Nru libssh-0.10.6/debian/patches/CVE-2025-8277-3.patch
libssh-0.10.6/debian/patches/CVE-2025-8277-3.patch
--- libssh-0.10.6/debian/patches/CVE-2025-8277-3.patch 1970-01-01
01:00:00.000000000 +0100
+++ libssh-0.10.6/debian/patches/CVE-2025-8277-3.patch 2025-11-26
10:29:30.000000000 +0100
@@ -0,0 +1,44 @@
+From 8e4d67aa9eda455bfad9ac610e54b7a548d0aa08 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Wed, 6 Aug 2025 11:10:38 +0200
+Subject: CVE-2025-8277: ecdh: Free previously allocated pubkeys
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+(cherry picked from commit c9d95ab0c7a52b231bcec09afbea71944ed0d852)
+---
+ src/ecdh_crypto.c | 1 +
+ src/ecdh_gcrypt.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/ecdh_crypto.c b/src/ecdh_crypto.c
+index a286804f4..fb707c321 100644
+--- a/src/ecdh_crypto.c
++++ b/src/ecdh_crypto.c
+@@ -230,6 +230,7 @@ int ssh_client_ecdh_init(ssh_session session)
+
+
+ session->next_crypto->ecdh_privkey = key;
++ ssh_string_free(session->next_crypto->ecdh_client_pubkey);
+ session->next_crypto->ecdh_client_pubkey = client_pubkey;
+
+ /* register the packet callbacks */
+diff --git a/src/ecdh_gcrypt.c b/src/ecdh_gcrypt.c
+index 8eabfe181..5dcd3929a 100644
+--- a/src/ecdh_gcrypt.c
++++ b/src/ecdh_gcrypt.c
+@@ -106,9 +106,10 @@ int ssh_client_ecdh_init(ssh_session session)
+ gcry_sexp_release(session->next_crypto->ecdh_privkey);
+ session->next_crypto->ecdh_privkey = NULL;
+ }
+-
+ session->next_crypto->ecdh_privkey = key;
+ key = NULL;
++
++ SSH_STRING_FREE(session->next_crypto->ecdh_client_pubkey);
+ session->next_crypto->ecdh_client_pubkey = client_pubkey;
+ client_pubkey = NULL;
+
+--
+cgit v1.2.3
+
diff -Nru libssh-0.10.6/debian/patches/CVE-2025-8277-4.patch
libssh-0.10.6/debian/patches/CVE-2025-8277-4.patch
--- libssh-0.10.6/debian/patches/CVE-2025-8277-4.patch 1970-01-01
01:00:00.000000000 +0100
+++ libssh-0.10.6/debian/patches/CVE-2025-8277-4.patch 2025-11-26
10:29:30.000000000 +0100
@@ -0,0 +1,44 @@
+From 1c763e29d138db87665e98983f468d2dd0f286c1 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <[email protected]>
+Date: Wed, 6 Aug 2025 15:32:56 +0200
+Subject: CVE-2025-8277: mbedtls: Avoid leaking ecdh keys
+
+Signed-off-by: Jakub Jelen <[email protected]>
+Reviewed-by: Andreas Schneider <[email protected]>
+(cherry picked from commit ffed80f8c078122990a4eba2b275facd56dd43e0)
+---
+ src/ecdh_mbedcrypto.c | 1 +
+ src/wrapper.c | 5 ++++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/ecdh_mbedcrypto.c b/src/ecdh_mbedcrypto.c
+index d31bfcc7a..860543d61 100644
+--- a/src/ecdh_mbedcrypto.c
++++ b/src/ecdh_mbedcrypto.c
+@@ -116,6 +116,7 @@ int ssh_client_ecdh_init(ssh_session session)
+ goto out;
+ }
+
++ SSH_STRING_FREE(session->next_crypto->ecdh_client_pubkey);
+ session->next_crypto->ecdh_client_pubkey = client_pubkey;
+ client_pubkey = NULL;
+
+diff --git a/src/wrapper.c b/src/wrapper.c
+index 8996b8ce6..625130166 100644
+--- a/src/wrapper.c
++++ b/src/wrapper.c
+@@ -181,7 +181,10 @@ void crypto_free(struct ssh_crypto_struct *crypto)
+ #endif /* OPENSSL_VERSION_NUMBER */
+ #elif defined HAVE_GCRYPT_ECC
+ gcry_sexp_release(crypto->ecdh_privkey);
+-#endif
++#elif defined HAVE_LIBMBEDCRYPTO
++ mbedtls_ecp_keypair_free(crypto->ecdh_privkey);
++ SAFE_FREE(crypto->ecdh_privkey);
++#endif /* HAVE_LIBGCRYPT */
+ crypto->ecdh_privkey = NULL;
+ }
+ #endif
+--
+cgit v1.2.3
+
diff -Nru libssh-0.10.6/debian/patches/series
libssh-0.10.6/debian/patches/series
--- libssh-0.10.6/debian/patches/series 2023-12-25 11:15:40.000000000 +0100
+++ libssh-0.10.6/debian/patches/series 2025-11-26 10:29:30.000000000 +0100
@@ -1,5 +1,16 @@
0001-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch
0002-tests-Increase-test-coverage-for-IPv6-address-parsin.patch
+0003-CVE-2025-4877-base64-Prevent-integer-overflow-and-po.patch
+0004-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
+0005-CVE-2025-4878-legacy-Properly-check-return-value-to-.patch
+0006-CVE-2025-5351-pki_crypto-Avoid-double-free-on-low-me.patch
+0007-CVE-2025-5987-libcrypto-Correctly-detect-failures-of.patch
+0008-CVE-2025-5372-libgcrypto-Simplify-error-checking-and.patch
1003-custom-lib-names.patch
2003-disable-expand_tilde_unix-test.patch
2004-install-static-lib.patch
+CVE-2025-8114.patch
+CVE-2025-8277-1.patch
+CVE-2025-8277-2.patch
+CVE-2025-8277-3.patch
+CVE-2025-8277-4.patch
--- End Message ---
