On Fri Jul 17, 2026 at 3:50 PM CEST, Adarsh Jagadish Kamini via lists.openembedded.org wrote: > From: Adarsh Jagadish Kamini <[email protected]> > > Backport patch to fix CVE-2026-58050. > https://nvd.nist.gov/vuln/detail/CVE-2026-58050 > > Upstream fix: > > https://github.com/libssh2/libssh2/commit/7c8a170c6dca3cd4cf24de836f43ba1a20e662d5 > > The upstream commit uses the shortened private-symbol namespace > introduced in commit 076838de2697a4185125bfd601fbcd6e7286bfb6 > ("src: shorten namespace for private functions and macros"), which is > not present in libssh2 1.11.1. The only change made when backporting was > to spell the helper calls back to the names used in 1.11.1: > > ssh2_err() -> _libssh2_error() > ssh2_ntohu32() -> _libssh2_ntohu32() > > The added "> LIBSSH2_PACKET_MAXPAYLOAD" cap checks were kept as-is, > written against this tree's existing bounds-check style > (s + len <= data + data_len). > > Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
As far as I can tell, this CVE-2026-58050 also applies to master. Can you send a fix so I can accept this on wrynose and scarthgap? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241518): https://lists.openembedded.org/g/openembedded-core/message/241518 Mute This Topic: https://lists.openembedded.org/mt/120315451/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
