Le sam. 27 juin 2026, 09:47, Daniel Turull <[email protected]> a écrit :
> Hi, > I have sent the wrong version of the patch. I realized on the same issue > when I created the wrynose one and I had this version in my scarthgap build. > > It should have been the same that I sent for wrynose and master. Those are > correct. It is the same libssh2 version. > > I'll resend a v2 on Monday. > > I really thought I sent the same patch to the three releases. > > In the future, if it is the same patch to multiple branches, how should it > be marked? > Nothing in particular: this is not a frequent case and there is no special case for it. Send a patch per branch as usual. Thanks! > > Thanks > Daniel > ------------------------------ > *From:* Yoann Congal <[email protected]> > *Sent:* Saturday, June 27, 2026 1:06 AM > *To:* Daniel Turull <[email protected]>; > [email protected] < > [email protected]> > *Cc:* [email protected] <[email protected]> > *Subject:* Re: [OE-core] [scarthgap] [patch] libssh2: fix CVE-2026-55200 > > On Mon Jun 22, 2026 at 11:33 AM CEST, Daniel Turull via > lists.openembedded.org wrote: > > From: Daniel Turull <[email protected]> > > > > Backport patch to fix CVE-2026-55200. > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln%2Fdetail%2FCVE-2026-55200&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971761508%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=tmWBrZABG8OQtWK6Cds18odLAc%2FOcm4ql3en4e0Wgio%3D&reserved=0 > <https://nvd.nist.gov/vuln/detail/CVE-2026-55200> > > > > Upstream fix: > > > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flibssh2%2Flibssh2%2Fcommit%2F97acf3dfda80c91c3a8c9f2372546301d4a1a7a8&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971778602%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ct5f7AASg%2FMtVlbo6YFwhO4C1xrUbTzkI3J7pTZpCRM%3D&reserved=0 > <https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8> > > > > Tested with ptest: > > Before: PASSED: 3, FAILED: 0, SKIPPED: 0 > > After: PASSED: 3, FAILED: 0, SKIPPED: 0 > > > > Reviewed-by: Anders Heimer <[email protected] > > Signed-off-by: Daniel Turull <[email protected]> > > --- > > .../libssh2/libssh2/CVE-2026-55200.patch | 51 +++++++++++++++++++ > > .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + > > 2 files changed, 52 insertions(+) > > create mode 100644 > meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > > > > diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > b/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > > new file mode 100644 > > index 00000000000..f5ab9b9f204 > > --- /dev/null > > +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-55200.patch > > @@ -0,0 +1,51 @@ > > +From df0b03ee5ef12f3a46fccc0fc688ebfb91702972 Mon Sep 17 00:00:00 2001 > > +From: Will Cosgrove <[email protected]> > > +Date: Fri, 12 Jun 2026 15:57:44 -0700 > > +Subject: [PATCH] transport.c: Additional boundary checks for packet > length > > + (#2052) > > +MIME-Version: 1.0 > > +Content-Type: text/plain; charset=UTF-8 > > +Content-Transfer-Encoding: 8bit > > + > > +Backport Resolution: Add additional bounds checking on packet length to > > +prevent OOB write — checks that packet_length is not below 1 and not > > +above LIBSSH2_PACKET_MAXPAYLOAD before proceeding. > > + > > +Conflicts Resolved: > > + > > +src/transport.c (1 conflict): > > +- Upstream uses renamed API ssh2_ntohu32(); stable branch uses > > + _libssh2_ntohu32(). Kept stable function name while applying the > > + new upper-bound check (LIBSSH2_PACKET_MAXPAYLOAD) unchanged. > > + > > +Assisted-by: kiro:claude-sonnet-4.6 > > + > > +Changes from upstream commit 97acf3dfda80: > > + - src/transport.c: adapted from upstream > > While resolving the conflict, your AI completely rewrote the patch > message and notably removed the Credit: line. > > Please keep the original patch message and put the backporting > information below the "Upstream-Status:" line. While you changing this, > the conflict resolution is trivial, no need to be so verbose (a line > referencing ssh2_ntohu32 should be enough). > > Thanks! > > > + > > +CVE: CVE-2026-55200 > > +Upstream-Status: Backport [ > https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flibssh2%2Flibssh2%2Fcommit%2F97acf3dfda80c91c3a8c9f2372546301d4a1a7a8&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971788230%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=2qunEVqQYFYAKjgr3pUGogxQYBa9GYLKBT%2FQslEJb9o%3D&reserved=0 > <https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8> > ] > > + > > +Signed-off-by: Daniel Turull <[email protected]> > > +--- > > + src/transport.c | 6 +++++- > > + 1 file changed, 5 insertions(+), 1 deletion(-) > > + > > +diff --git a/src/transport.c b/src/transport.c > > +index e1120656..d147505b 100644 > > +--- a/src/transport.c > > ++++ b/src/transport.c > > +@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * > session) > > + total_num = 4; > > + > > + p->packet_length = _libssh2_ntohu32(block); > > +- if(p->packet_length < 1) > > ++ if(p->packet_length < 1) { > > + return LIBSSH2_ERROR_DECRYPT; > > ++ } > > ++ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) { > > ++ return LIBSSH2_ERROR_OUT_OF_BOUNDARY; > > ++ } > > + > > + /* total_num may include size field, however due to > existing > > + * logic it needs to be removed after the entire > packet is read > > diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > > index 2284d054b10..d6ee97f7ed0 100644 > > --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > > +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > > @@ -11,6 +11,7 @@ SRC_URI = " > https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.libssh2.org%2Fdownload%2F%24&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971797263%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=b6xuzsvaWoBiC%2BiylM5H5sHW7Boo2xTyzR7gquZrO1g%3D&reserved=0{BP}.tar.gz > <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.libssh2.org%2Fdownload%2F%24&data=05%7C02%7Cdaniel.turull%40ericsson.com%7C2f3364dd9a284c28d67508ded3d79154%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C639181119971797263%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=b6xuzsvaWoBiC%2BiylM5H5sHW7Boo2xTyzR7gquZrO1g%3D&reserved=0%7BBP%7D.tar.gz> > \ > > file://run-ptest \ > > > file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \ > > file://CVE-2026-7598.patch \ > > + file://CVE-2026-55200.patch \ > > " > > > > SRC_URI[sha256sum] = > "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" > > > -- > Yoann Congal > Smile ECS > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#239693): https://lists.openembedded.org/g/openembedded-core/message/239693 Mute This Topic: https://lists.openembedded.org/mt/119921124/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
