On Mon Jun 22, 2026 at 11:33 AM CEST, Daniel Turull via lists.openembedded.org wrote: > From: Daniel Turull <[email protected]> > > Backport patch to fix CVE-2026-55200. > https://nvd.nist.gov/vuln/detail/CVE-2026-55200 > > Upstream fix: > > https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 > > Tested with ptest: > Before: PASSED: 3, FAILED: 0, SKIPPED: 0 > After: PASSED: 3, FAILED: 0, SKIPPED: 0 > > Reviewed-by: Anders Heimer <[email protected] > Signed-off-by: Daniel Turull <[email protected]> > --- > .../libssh2/libssh2/CVE-2026-55200.patch | 51 +++++++++++++++++++ > .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + > 2 files changed, 52 insertions(+) > create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > > diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > b/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > new file mode 100644 > index 00000000000..f5ab9b9f204 > --- /dev/null > +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > @@ -0,0 +1,51 @@ > +From df0b03ee5ef12f3a46fccc0fc688ebfb91702972 Mon Sep 17 00:00:00 2001 > +From: Will Cosgrove <[email protected]> > +Date: Fri, 12 Jun 2026 15:57:44 -0700 > +Subject: [PATCH] transport.c: Additional boundary checks for packet length > + (#2052) > +MIME-Version: 1.0 > +Content-Type: text/plain; charset=UTF-8 > +Content-Transfer-Encoding: 8bit > + > +Backport Resolution: Add additional bounds checking on packet length to > +prevent OOB write — checks that packet_length is not below 1 and not > +above LIBSSH2_PACKET_MAXPAYLOAD before proceeding. > + > +Conflicts Resolved: > + > +src/transport.c (1 conflict): > +- Upstream uses renamed API ssh2_ntohu32(); stable branch uses > + _libssh2_ntohu32(). Kept stable function name while applying the > + new upper-bound check (LIBSSH2_PACKET_MAXPAYLOAD) unchanged. > + > +Assisted-by: kiro:claude-sonnet-4.6 > + > +Changes from upstream commit 97acf3dfda80: > + - src/transport.c: adapted from upstream
While resolving the conflict, your AI completely rewrote the patch message and notably removed the Credit: line. Please keep the original patch message and put the backporting information below the "Upstream-Status:" line. While you changing this, the conflict resolution is trivial, no need to be so verbose (a line referencing ssh2_ntohu32 should be enough). Thanks! > + > +CVE: CVE-2026-55200 > +Upstream-Status: Backport > [https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8] > + > +Signed-off-by: Daniel Turull <[email protected]> > +--- > + src/transport.c | 6 +++++- > + 1 file changed, 5 insertions(+), 1 deletion(-) > + > +diff --git a/src/transport.c b/src/transport.c > +index e1120656..d147505b 100644 > +--- a/src/transport.c > ++++ b/src/transport.c > +@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session) > + total_num = 4; > + > + p->packet_length = _libssh2_ntohu32(block); > +- if(p->packet_length < 1) > ++ if(p->packet_length < 1) { > + return LIBSSH2_ERROR_DECRYPT; > ++ } > ++ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) { > ++ return LIBSSH2_ERROR_OUT_OF_BOUNDARY; > ++ } > + > + /* total_num may include size field, however due to existing > + * logic it needs to be removed after the entire packet is > read > diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > index 2284d054b10..d6ee97f7ed0 100644 > --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > @@ -11,6 +11,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ > file://run-ptest \ > file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \ > file://CVE-2026-7598.patch \ > + file://CVE-2026-55200.patch \ > " > > SRC_URI[sha256sum] = > "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#239669): https://lists.openembedded.org/g/openembedded-core/message/239669 Mute This Topic: https://lists.openembedded.org/mt/119921124/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
