On Fri Jul 17, 2026 at 3:52 PM CEST, Adarsh Jagadish Kamini via lists.openembedded.org wrote: > From: Adarsh Jagadish Kamini <[email protected]> > > Backport patch to fix CVE-2026-58050. > https://nvd.nist.gov/vuln/detail/CVE-2026-58050 > > Upstream fix: > > https://github.com/libssh2/libssh2/commit/7c8a170c6dca3cd4cf24de836f43ba1a20e662d5 > > The upstream commit uses the shortened private-symbol namespace > introduced in commit 076838de2697a4185125bfd601fbcd6e7286bfb6 > ("src: shorten namespace for private functions and macros"), which is > not present in libssh2 1.11.1. The only change made when backporting was > to spell the helper calls back to the names used in 1.11.1: > > ssh2_err() -> _libssh2_error() > ssh2_ntohu32() -> _libssh2_ntohu32() > > The added "> LIBSSH2_PACKET_MAXPAYLOAD" cap checks were kept as-is, > written against this tree's existing bounds-check style > (s + len <= data + data_len). > > Signed-off-by: Adarsh Jagadish Kamini <[email protected]> > --- > .../libssh2/libssh2/CVE-2026-58050.patch | 177 ++++++++++++++++++ > .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + > 2 files changed, 178 insertions(+) > create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-58050.patch
Same as the wrynose patch. This needs a fix fox master. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241519): https://lists.openembedded.org/g/openembedded-core/message/241519 Mute This Topic: https://lists.openembedded.org/mt/120315452/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
