On Mon Jun 29, 2026 at 10:19 AM CEST, daniel.turull wrote: > From: Daniel Turull <[email protected]> > > Backport patch to fix CVE-2026-55199. > https://nvd.nist.gov/vuln/detail/CVE-2026-55199 > > Upstream fix: > > https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4 > > Tested with ptest: > Before: PASSED: 3, FAILED: 0, SKIPPED: 0 > After: PASSED: 3, FAILED: 0, SKIPPED: 0 > > Reviewed-by: Anders Heimer <[email protected] Hello
The Reviewed-by: line is missing a '>' at the end. I've fixed it. Regards, > Signed-off-by: Daniel Turull <[email protected]> > --- > .../libssh2/libssh2/CVE-2026-55199.patch | 44 +++++++++++++++++++ > .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + > 2 files changed, 45 insertions(+) > create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch > > diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch > b/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch > new file mode 100644 > index 0000000000..81815486ad > --- /dev/null > +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-55199.patch > @@ -0,0 +1,44 @@ > +From b5cb1c1781ba5f275485f65855d61faaba6542b2 Mon Sep 17 00:00:00 2001 > +From: TristanInSec <[email protected]> > +Date: Wed, 15 Apr 2026 14:51:08 -0400 > +Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO` > + handler > + > +The `SSH_MSG_EXT_INFO` handler discards the return values from > +`_libssh2_get_string()` when parsing extension name/value pairs. When > +the buffer is exhausted before all claimed extensions are parsed, > +the loop continues with no-op iterations until `nr_extensions` reaches > +zero. > + > +The `nr_extensions >= 1024` cap limits the worst case, but the loop > +should still break on parse failure for correctness and consistency > +with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`, > +`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values. > + > +Closes #1864 > + > +CVE: CVE-2026-55199 > +Upstream-Status: Backport > [https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4] > + > +Signed-off-by: Daniel Turull <[email protected]> > +--- > + src/packet.c | 6 ++++-- > + 1 file changed, 4 insertions(+), 2 deletions(-) > + > +diff --git a/src/packet.c b/src/packet.c > +index 6da14e9f..ebaddae5 100644 > +--- a/src/packet.c > ++++ b/src/packet.c > +@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned > char *data, > + > + nr_extensions -= 1; > + > +- _libssh2_get_string(&buf, &name, &name_len); > +- _libssh2_get_string(&buf, &value, &value_len); > ++ if(_libssh2_get_string(&buf, &name, &name_len)) > ++ break; > ++ if(_libssh2_get_string(&buf, &value, &value_len)) > ++ break; > + > + if(name && value) { > + _libssh2_debug((session, > diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > index 5ffc40b8fc..2407ed34d9 100644 > --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb > +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb > @@ -12,6 +12,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ > file://0001-Return-error-if-user-KEX-methods-are-invalid.patch \ > file://CVE-2026-7598.patch \ > file://CVE-2026-55200.patch \ > + file://CVE-2026-55199.patch \ > " > > SRC_URI[sha256sum] = > "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240121): https://lists.openembedded.org/g/openembedded-core/message/240121 Mute This Topic: https://lists.openembedded.org/mt/120027325/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
