Hi, I have sent the wrong version of the patch. I realized on the same issue when I created the wrynose one and I had this version in my scarthgap build.
It should have been the same that I sent for wrynose and master. Those are correct. It is the same libssh2 version. I'll resend a v2 on Monday. I really thought I sent the same patch to the three releases. In the future, if it is the same patch to multiple branches, how should it be marked? Thanks Daniel ________________________________ From: Yoann Congal <[email protected]> Sent: Saturday, June 27, 2026 1:06 AM To: Daniel Turull <[email protected]>; [email protected] <[email protected]> Cc: [email protected] <[email protected]> Subject: Re: [OE-core] [scarthgap] [patch] libssh2: fix CVE-2026-55200 On Mon Jun 22, 2026 at 11:33 AM CEST, Daniel Turull via lists.openembedded.org wrote: > From: Daniel Turull <[email protected]> > > Backport patch to fix CVE-2026-55200. > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln%2Fdetail%2FCVE-2026-55200&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971761508%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=tmWBrZABG8OQtWK6Cds18odLAc%2FOcm4ql3en4e0Wgio%3D&reserved=0<https://nvd.nist.gov/vuln/detail/CVE-2026-55200> > > Upstream fix: > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flibssh2%2Flibssh2%2Fcommit%2F97acf3dfda80c91c3a8c9f2372546301d4a1a7a8&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971778602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ct5f7AASg%2FMtVlbo6YFwhO4C1xrUbTzkI3J7pTZpCRM%3D&reserved=0<https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8> > > Tested with ptest: > Before: PASSED: 3, FAILED: 0, SKIPPED: 0 > After: PASSED: 3, FAILED: 0, SKIPPED: 0 > > Reviewed-by: Anders Heimer <[email protected] > Signed-off-by: Daniel Turull <[email protected]> > --- > .../libssh2/libssh2/CVE-2026-55200.patch | 51 +++++++++++++++++++ > .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + > 2 files changed, 52 insertions(+) > create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > > diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > b/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > new file mode 100644 > index 00000000000..f5ab9b9f204 > --- /dev/null > +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > @@ -0,0 +1,51 @@ > +From df0b03ee5ef12f3a46fccc0fc688ebfb91702972 Mon Sep 17 00:00:00 2001 > +From: Will Cosgrove <[email protected]> > +Date: Fri, 12 Jun 2026 15:57:44 -0700 > +Subject: [PATCH] transport.c: Additional boundary checks for packet length > + (#2052) > +MIME-Version: 1.0 > +Content-Type: text/plain; charset=UTF-8 > +Content-Transfer-Encoding: 8bit > + > +Backport Resolution: Add additional bounds checking on packet length to > +prevent OOB write — checks that packet_length is not below 1 and not > +above LIBSSH2_PACKET_MAXPAYLOAD before proceeding. > + > +Conflicts Resolved: > + > +src/transport.c (1 conflict): > +- Upstream uses renamed API ssh2_ntohu32(); stable branch uses > + _libssh2_ntohu32(). Kept stable function name while applying the > + new upper-bound check (LIBSSH2_PACKET_MAXPAYLOAD) unchanged. > + > +Assisted-by: kiro:claude-sonnet-4.6 > + > +Changes from upstream commit 97acf3dfda80: > + - src/transport.c: adapted from upstream While resolving the conflict, your AI completely rewrote the patch message and notably removed the Credit: line. Please keep the original patch message and put the backporting information below the "Upstream-Status:" line. While you changing this, the conflict resolution is trivial, no need to be so verbose (a line referencing ssh2_ntohu32 should be enough). Thanks! > + > +CVE: CVE-2026-55200 > +Upstream-Status: Backport > [https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flibssh2%2Flibssh2%2Fcommit%2F97acf3dfda80c91c3a8c9f2372546301d4a1a7a8&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971788230%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=2qunEVqQYFYAKjgr3pUGogxQYBa9GYLKBT%2FQslEJb9o%3D&reserved=0<https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8>] > + > +Signed-off-by: Daniel Turull <[email protected]> > +--- > + src/transport.c | 6 +++++- > + 1 file changed, 5 insertions(+), 1 deletion(-) > + > +diff --git a/src/transport.c b/src/transport.c > +index e1120656..d147505b 100644 > +--- a/src/transport.c > ++++ b/src/transport.c > +@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session) > + total_num = 4; > + > + p->packet_length = _libssh2_ntohu32(block); > +- if(p->packet_length < 1) > ++ if(p->packet_length < 1) { > + return LIBSSH2_ERROR_DECRYPT; > ++ } > ++ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) { > ++ return LIBSSH2_ERROR_OUT_OF_BOUNDARY; > ++ } > + > + /* total_num may include size field, however due to existing > + * logic it needs to be removed after the entire packet is > read > diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > index 2284d054b10..d6ee97f7ed0 100644 > --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > @@ -11,6 +11,7 @@ SRC_URI = > "https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.libssh2.org%2Fdownload%2F%24&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971797263%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=b6xuzsvaWoBiC%2BiylM5H5sHW7Boo2xTyzR7gquZrO1g%3D&reserved=0{BP}.tar.gz > \ > file://run-ptest \ > file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \ > file://CVE-2026-7598.patch \ > + file://CVE-2026-55200.patch \ > " > > SRC_URI[sha256sum] = > "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#239684): https://lists.openembedded.org/g/openembedded-core/message/239684 Mute This Topic: https://lists.openembedded.org/mt/119921124/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
