Bug#1142537: marked as done (libssh: CVE-2026-15370 CVE-2026-59842 CVE-2026-59843 CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-59849 CVE-2026-59850 CVE-2026-59851)

This is a multi-part message in MIME format...

------------=_1785772143-2828608-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Mon, 03 Aug 2026 15:48:16 +0000
with message-id <[email protected]>
and subject line Bug#1142537: fixed in libssh 0.11.5-0+deb13u1
has caused the Debian Bug report #1142537,
regarding libssh: CVE-2026-15370 CVE-2026-59842 CVE-2026-59843 CVE-2026-598=
44 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-598=
49 CVE-2026-59850 CVE-2026-59851
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
1142537: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1142537
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1785772143-2828608-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 21 Jul 2026 12:38:12 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00,FOURLA,FROMDEVELOPER,
	NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 53; hammy, 150; neutral, 159; spammy,
	0. spammytokens: hammytokens:0.000-+--XDebbugsCc,
	0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--trixie,
	0.000-+--H*Ad:N*Bug
Return-path: <[email protected]>
Received: via submission
	by buxtehude.debian.org with esmtp (Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wm9je-007XcM-1P
	for [email protected];
	Tue, 21 Jul 2026 12:38:12 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: libssh: CVE-2026-15370 CVE-2026-59842 CVE-2026-59843 CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-59849 CVE-2026-59850 CVE-2026-59851
Message-ID: <[email protected]>
X-Mailer: reportbug 13.2.0+nmu1
Date: Tue, 21 Jul 2026 14:38:08 +0200
Delivered-To: [email protected]

Source: libssh
Version: 0.12.0-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for libssh.

Making a RC bug due to the amount of CVEs mainly and two CVEs only
relevant for 0.12.0. We still need to assess the rest for trixie.

CVE-2026-15370[0]:
| A flaw was found in libssh. During SFTP server directory listing,
| the longname field is constructed with unsafe concatenation into a
| fixed-size stack buffer. When a client causes the server to list
| attacker-controlled filenames, sufficiently long names can overflow
| that stack buffer and may lead to crashes or possible code execution
| on the server.


CVE-2026-59842[1]:
| A flaw was found in libssh. During server-side GSSAPI key exchange,
| a client-supplied Curve25519 public key shorter than the expected
| length is copied without proper length validation, leading to an
| out-of-bounds heap read. This could allow a remote unauthenticated
| attacker to disclose small amounts of server memory.


CVE-2026-59843[2]:
| A flaw was found in libssh. A remote authenticated peer can
| advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN,
| causing later channel writes to loop indefinitely and consume CPU,
| leading to denial of service.

Can you help on this one to identify the needed upstream change? There
is one from master branch referenced in the advisory but that does not
look to be backported to libssh-0.12.1? 


CVE-2026-59844[3]:
| A flaw was found in libssh. A remote authenticated client can issue
| SSH_FXP_READ requests with an arbitrarily large length, causing a
| libssh SFTP server to allocate excessive memory and potentially
| exhaust it through repeated requests.


CVE-2026-59845[4]:
| A flaw was found in libssh. When ProxyCommand is used, an unchecked
| fork() failure can be stored as process ID -1; during cleanup,
| signals may then be sent across the caller's accessible process
| tree, leading to local denial of service.


CVE-2026-59846[5]:
| Information disclosure via ProxyCommand %r username expansion


CVE-2026-59847[6]:
| Integrity downgrade via OpenSSL AES-GCM tag verification


CVE-2026-59848[7]:
| Denial of service via SFTP responses with unknown request IDs


CVE-2026-59849[8]:
| Denial of service via automatic certificate authentication loop


CVE-2026-59850[9]:
| Use-after-free via data callbacks on closed channels


CVE-2026-59851[10]:
| Authentication bypass via missing GSSAPI principal check


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15370
    https://www.cve.org/CVERecord?id=CVE-2026-15370
[1] https://security-tracker.debian.org/tracker/CVE-2026-59842
    https://www.cve.org/CVERecord?id=CVE-2026-59842
[2] https://security-tracker.debian.org/tracker/CVE-2026-59843
    https://www.cve.org/CVERecord?id=CVE-2026-59843
[3] https://security-tracker.debian.org/tracker/CVE-2026-59844
    https://www.cve.org/CVERecord?id=CVE-2026-59844
[4] https://security-tracker.debian.org/tracker/CVE-2026-59845
    https://www.cve.org/CVERecord?id=CVE-2026-59845
[5] https://security-tracker.debian.org/tracker/CVE-2026-59846
    https://www.cve.org/CVERecord?id=CVE-2026-59846
[6] https://security-tracker.debian.org/tracker/CVE-2026-59847
    https://www.cve.org/CVERecord?id=CVE-2026-59847
[7] https://security-tracker.debian.org/tracker/CVE-2026-59848
    https://www.cve.org/CVERecord?id=CVE-2026-59848
[8] https://security-tracker.debian.org/tracker/CVE-2026-59849
    https://www.cve.org/CVERecord?id=CVE-2026-59849
[9] https://security-tracker.debian.org/tracker/CVE-2026-59850
    https://www.cve.org/CVERecord?id=CVE-2026-59850
[10] https://security-tracker.debian.org/tracker/CVE-2026-59851
    https://www.cve.org/CVERecord?id=CVE-2026-59851

Regards,
Salvatore

------------=_1785772143-2828608-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 1142537-close) by bugs.debian.org; 3 Aug 2026 15:48:19 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD,
	HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED,
	SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham
	autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 10; hammy, 150; neutral, 393; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz,
	0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo
Return-path: <[email protected]>
Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:50296)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wqutn-00BrXc-1q
	for [email protected];
	Mon, 03 Aug 2026 15:48:19 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wqutl-00GzBD-2s
	for [email protected];
	Mon, 03 Aug 2026 15:48:17 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=4zeajXjiqVAaIaaBPQ0O/S6zMGLXfdwQ2MdXYWgdcig=; b=F73uqlmRBsv/P1opVwT4UYMuNU
	+eA+4A6PTcQt7wFZxKsxk+xu6GKVkslaJQFAIG71H2ySQq5J/D1eTchu7GJhjCuhOdplAM50ktbrc
	/xMr//XoAN5f7W0f0rBkTJ62l0rbnPWdVF+BMukCuO99fLWN9kHKnc8SDnZ+oWblEKfSzZaIWhr3q
	cWoYrC6bsFng9trha2ifrO2OvSamrp4tIbfAcebBi5pAoXzGWxnUxXpAvBUfOf8MdCBF+qRIabzhf
	naPr53HMlQdlSY/5OAKxPqBcSfPcEjzOd8VAi+UgCDRYX1PC9Qkw1Q+oPoc7Mt+HS/x94J7tlq1Sr
	TOwKxLcQ==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1wqutk-00000006quG-310D;
	Mon, 03 Aug 2026 15:48:16 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: Martin Pitt <[email protected]>
To: [email protected]
X-DAK: dak process-policy
X-Debian: DAK
X-Debian-Package: libssh
Debian: DAK
Debian-Changes: libssh_0.11.5-0+deb13u1_source.changes
Debian-Source: libssh
Debian-Version: 0.11.5-0+deb13u1
Debian-Architecture: source
Debian-Suite: proposed-updates
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#1142537: fixed in libssh 0.11.5-0+deb13u1
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============3820165103452461326=="
Message-Id: <[email protected]>
Date: Mon, 03 Aug 2026 15:48:16 +0000
X-CrossAssassin-Score: 2

--===============3820165103452461326==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: libssh
Source-Version: 0.11.5-0+deb13u1
Done: Martin Pitt <[email protected]>

We believe that the bug you reported is fixed in the latest version of
libssh, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Pitt <[email protected]> (supplier of updated libssh package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 01 Aug 2026 13:42:11 +0200
Source: libssh
Architecture: source
Version: 0.11.5-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Laurent Bigonville <[email protected]>
Changed-By: Martin Pitt <[email protected]>
Closes: 1127693 1142537
Changes:
 libssh (0.11.5-0+deb13u1) trixie-security; urgency=3Dmedium
 .
   * New upstream security/bug fix release 0.11.4:
     - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
     - CVE-2026-0965: Possible Denial of Service when parsing unexpected
       configuration files
     - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
     - CVE-2026-0967: Specially crafted patterns could cause DoS
     - CVE-2026-0968: OOB Read in sftp_parse_longname()
     - CVE-2026-3731: Read buffer overrun when handling SFTP extensions
     - Note: CVE-2025-14821 is Windows specific, does not apply to Linux
     https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-rele=
ases/
     (Closes: #1127693)
   * New upstream security/bug fix release 0.11.5:
     - CVE-2026-15370: Stack buffer overflow in SFTP server longname
       construction
     - CVE-2026-59843: Denial of service via zero advertised channel packet
       size
     - CVE-2026-59844: Denial of service via oversized SFTP read length
     - CVE-2026-59845: Denial of service via unchecked ProxyCommand fork()
       failure
     - CVE-2026-59846: Information disclosure via ProxyCommand %r username
       expansion
     - CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verificati=
on
     - CVE-2026-59848: Denial of service via SFTP responses with unknown
       request IDs
     - CVE-2026-59849: Denial of service via automatic certificate
       authentication loop
     - CVE-2026-59850: Use-after-free via data callbacks on closed channels
     - Zero-initialize every ssh_string
     https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-rele=
ases/
     (Closes: #1142537)
Checksums-Sha1:
 2087dc4964630a8390271bf4168f8091174e0573 2371 libssh_0.11.5-0+deb13u1.dsc
 004929095e3d23cfb3d999bec7779362afea9e73 629716 libssh_0.11.5.orig.tar.xz
 30146aedb82f2b3790a117c21bebdea05b063e04 31932 libssh_0.11.5-0+deb13u1.debia=
n.tar.xz
 7533bd519a94a351f5601b9babbf9d82f5acf448 8085 libssh_0.11.5-0+deb13u1_source=
.buildinfo
Checksums-Sha256:
 8aeaec786998691f4a2a320ae66943d3fa324882465d2a91f62658a13cd7bcff 2371 libssh=
_0.11.5-0+deb13u1.dsc
 6898ba9dd836d618b71dc7a4bb786a502c173cef5cafbf20fe5e0567ba4ea30c 629716 libs=
sh_0.11.5.orig.tar.xz
 00576a30d068e87813f96b1b8405d249d7fdaf75b9e61c5af775910dc15022fd 31932 libss=
h_0.11.5-0+deb13u1.debian.tar.xz
 5bc098fe907fae7fd6a6cf9d1dc7d94a5ef4c348cbb73e5c1fc489da4dfac847 8085 libssh=
_0.11.5-0+deb13u1_source.buildinfo
Files:
 6d954a139c57a013b8c955c7f576cb58 2371 libs optional libssh_0.11.5-0+deb13u1.=
dsc
 73aaa09a07041c6ec85b154cbcf604c3 629716 libs optional libssh_0.11.5.orig.tar=
.xz
 7388f83349450388d6cae899b1059c92 31932 libs optional libssh_0.11.5-0+deb13u1=
.debian.tar.xz
 270d452d8e4fe75f9f3a7b74904394ab 8085 libs optional libssh_0.11.5-0+deb13u1_=
source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmpuSoYACgkQ7nvd5Lhr
VxM1TA//ZzzSSGg3N+ZXXGyE6NXDuo8QYJu6FtQz+wg5EGIOGojrpZzPorlzQns9
xmj7xidBx8T1M2fnJf+PA4i8iT/P1ZzfXqOOZJYBHeUR4euW1TaxOcrgPjeaTEeo
jByYWX86FIIfGStutlAUIJUz77Lvf03rup2hY0ew3Cxj7z8/wFEnQ7zBxp6HbRlE
4v6ZFld8r/Bj7a/9O+YuCL0cA1E2QcUIoMqtibEatLKbmHD/guhNs1V9cfvcSEBh
+mkU1cTyKNFB8wlG+HC4VGrFpow01stdu/1Vl6fYd6nXhcmjd//gosvK0PNa/e0+
gAY12pdlxioSaOoJe3lpnIl0AjC7X8cCXOv+9eZIkJ1fRpikV4eX068Y+Y92TdWC
hGbgUxTSFSx0plvGhkkjLMq6p+f4ArQBqLc7TKSZpP3lfeCr4YmMSKkxs+hKzQCb
Wm5Or26CCqW/uAyDL2c/duWaLpLtb0R9LL5E08gNLqYrgN3HfSFkcN4w3eVPfjq4
JdKdVR22QaWlJAaKcAMyzLfsSi/kC2QR3Td3XbCZTW6mqZ3kZ21FJ3B6GLwy6ku5
tpynFbuupiRGCZMNRfRaH+6otfOftec0So9DAmaann8Yln8DzxDRL5xAvcGPkza3
8ppL0RzYX/j5onShhwpFonPlPWwFvnBt6vdLQg2BgFyz7A0R/E4=3D
=3DCuaC
-----END PGP SIGNATURE-----


--===============3820165103452461326==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanC4QAAKCRCb9qggYcy5
IbSgAP9Y0tesrTe6u/KhtLMc9Gam/yQtSgOf5f9vbEZdz+TpXwD+Mgu1S/SiPSSy
De4nJSDleM336w+Xj+h4DIVLwB+tOAw=
=45/O
-----END PGP SIGNATURE-----

--===============3820165103452461326==--
------------=_1785772143-2828608-0--