CVS commit: pkgsrc/security/libssh

This is a multi-part message in MIME format.

--_----------=_178578616119420
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"

Module Name:	pkgsrc
Committed By:	wiz
Date:		Mon Aug  3 19:42:41 UTC 2026

Modified Files:
	pkgsrc/security/libssh: Makefile PLIST distinfo
	pkgsrc/security/libssh/patches: patch-tests_torture.c

Log Message:
libssh: update to 0.12.1.

version 0.12.1 (released 2026-07-21)
 * Security:
   * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
   * CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
   * CVE-2026-59843: Denial of service via zero advertised channel packet size
   * CVE-2026-59844: Denial of service via oversized SFTP read length
   * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
   * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
   * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
   * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
   * CVE-2026-59849: Denial of service via automatic certificate authentication loop
   * CVE-2026-59850: Use-after-free via data callbacks on closed channels
   * CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
   * Zero-initialize every ssh_string
 * Compatibility:
   * Fix compatibility with C23 / gcc16
   * Allow hybrid ML-KEM key exchange in FIPS mode
 * Bugfixes:
   * Fix multiple memory leaks, null checks, and error checks
   * Fix parameter size mismatch in mlkem768x25519-sha256
   * Fix client SFTP messages being ignored if sent at high rate
   * Validate peer public key in DH key exchange
   * Fix ambiguous error reporting of sftp_init
   * Fix hidden integer underflow in socket packet callback
   * Avoid remote window overflow
   * Fix socket data callback return value on rekey failure
   * Avoid off-by-one overflow during kbdint authentication
   * Avoid logging uninitialized sequence numbers
   * Avoid double conversion of SFTP version number
   * Send correct SFTP server version number
   * Avoid handling repeated SFTP INIT messages
   * Harmonize return values from SFTP server callbacks

version 0.12.0 (released 2026-02-10)
 * Deprecations and removals:
   * Bumped minimal RSA key size to 1024 bits
 * New functionality:
   * Add support for hybrid key exchange mechanisms using Quantum Resistant
     cryptography for all backends. These are now preferred:
     * sntrup761x25519-sha512, [email protected]
     * mlkem768nistp256-sha256
     * mlkem768x25519-sha256
     * mlkem1024nistp384-sha384 (only OpenSSL 3.5+ and libgcrypt)
   * New cmake option WITH_HERMETIC_USR
   * Added support for Ed25519 keys through PKCS#11
   * Support for host-bound public key authentication
     ([email protected])
   * Use curve25519 implementation from mbedTLS and libgcrypt
   * New functions for signing arbitrary data (commits) with SSH keys
     * sshsig_sign()
     * sshsig_verify()
   * Support for FIDO/U2F keys (internal implementation using libfido2)
     * Compatible with OpenSSH: should work out of the box
     * Extensible with callbacks
   * Add support for GSSAPI Key Exchange (RFC 4462, RFC 8732)
   * Add support for new configuration options (client and server):
     * RequiredRsaSize
     * AddressFamily (client)
     * GSSAPIKeyExchange
     * GSSAPIKexAlgorithms
   * New option to get list of configured identities (SSH_OPTIONS_NEXT_IDENTITY)
   * More OpenSSH compatible percent expansion characters
   * Add new server auth_kbdint_function() callback
   * New PKI Context structure for key operations
   * Stability and compatibility improvements of ProxyJump
 * SFTP
   * Prevent failures when SFTP status message does not contain error message
   * Fix possible timeouts while waiting for SFTP messages
   * Support for [email protected] extension in client
   * Support for SSH_FXF_TRUNC in server


To generate a diff of this commit:
cvs rdiff -u -r1.59 -r1.60 pkgsrc/security/libssh/Makefile
cvs rdiff -u -r1.24 -r1.25 pkgsrc/security/libssh/PLIST
cvs rdiff -u -r1.36 -r1.37 pkgsrc/security/libssh/distinfo
cvs rdiff -u -r1.2 -r1.3 pkgsrc/security/libssh/patches/patch-tests_torture.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


--_----------=_178578616119420
Content-Disposition: inline
Content-Length: 3609
Content-Transfer-Encoding: binary
Content-Type: text/x-diff; charset=us-ascii

Modified files:

Index: pkgsrc/security/libssh/Makefile
diff -u pkgsrc/security/libssh/Makefile:1.59 pkgsrc/security/libssh/Makefile:1.60
--- pkgsrc/security/libssh/Makefile:1.59	Thu Jul 23 09:25:55 2026
+++ pkgsrc/security/libssh/Makefile	Mon Aug  3 19:42:41 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.59 2026/07/23 09:25:55 wiz Exp $
+# $NetBSD: Makefile,v 1.60 2026/08/03 19:42:41 wiz Exp $
 
-DISTNAME=	libssh-0.11.5
+DISTNAME=	libssh-0.12.1
 CATEGORIES=	security
 MASTER_SITES=	https://www.libssh.org/files/${PKGVERSION_NOREV:R}/
 EXTRACT_SUFX=	.tar.xz

Index: pkgsrc/security/libssh/PLIST
diff -u pkgsrc/security/libssh/PLIST:1.24 pkgsrc/security/libssh/PLIST:1.25
--- pkgsrc/security/libssh/PLIST:1.24	Thu Jul 23 09:25:55 2026
+++ pkgsrc/security/libssh/PLIST	Mon Aug  3 19:42:41 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.24 2026/07/23 09:25:55 wiz Exp $
+@comment $NetBSD: PLIST,v 1.25 2026/08/03 19:42:41 wiz Exp $
 include/libssh/callbacks.h
 include/libssh/legacy.h
 include/libssh/libssh.h
@@ -13,5 +13,5 @@ lib/cmake/libssh/libssh-config-version.c
 lib/cmake/libssh/libssh-config.cmake
 lib/libssh.so
 lib/libssh.so.4
-lib/libssh.so.4.10.5
+lib/libssh.so.4.11.1
 lib/pkgconfig/libssh.pc

Index: pkgsrc/security/libssh/distinfo
diff -u pkgsrc/security/libssh/distinfo:1.36 pkgsrc/security/libssh/distinfo:1.37
--- pkgsrc/security/libssh/distinfo:1.36	Thu Jul 23 09:25:55 2026
+++ pkgsrc/security/libssh/distinfo	Mon Aug  3 19:42:41 2026
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.36 2026/07/23 09:25:55 wiz Exp $
+$NetBSD: distinfo,v 1.37 2026/08/03 19:42:41 wiz Exp $
 
-BLAKE2s (libssh-0.11.5.tar.xz) = 8680a65333de0083ca40296c88ccca0c937b77821564353398ec0ed8995ceb7a
-SHA512 (libssh-0.11.5.tar.xz) = bf565de9a429d173c88a4b182c37efe242392751441e84bc30335ae95eeeb264fc2783744fbdc80267bd76a0cbb96ebef04b9d9b7f4a76890974e6ee05c14257
-Size (libssh-0.11.5.tar.xz) = 629716 bytes
+BLAKE2s (libssh-0.12.1.tar.xz) = fa92a959e4afe5bac582c4599810724c7173ef08d679128c6a5507bef10fc7d5
+SHA512 (libssh-0.12.1.tar.xz) = 4702930a1005d08f171281eab8e1246661410c1f0d94ec5a370115ad72995ab31780e28c372913fb46ec7d8e2590d9176ee1a3c777c173135a82f74718a62694
+Size (libssh-0.12.1.tar.xz) = 756384 bytes
 SHA1 (patch-CompilerChecks.cmake) = 8a650be5b69e956a0a54f54b71c4927ce685b8ca
 SHA1 (patch-examples_sshd__direct-tcpip.c) = 62de8625d58dbc03c38b0eb23f6e7f20a46e91de
 SHA1 (patch-tests_CMakeLists.txt) = b5baa8db2161d3f1c7aab317b2919de5dbca6e6a
-SHA1 (patch-tests_torture.c) = 39831812d1b7d16eaf0f6e4b867f4c453278afbd
+SHA1 (patch-tests_torture.c) = 6db2304741af946d1acad2d37a1ebbf23afba0c0

Index: pkgsrc/security/libssh/patches/patch-tests_torture.c
diff -u pkgsrc/security/libssh/patches/patch-tests_torture.c:1.2 pkgsrc/security/libssh/patches/patch-tests_torture.c:1.3
--- pkgsrc/security/libssh/patches/patch-tests_torture.c:1.2	Thu Jul 23 09:25:56 2026
+++ pkgsrc/security/libssh/patches/patch-tests_torture.c	Mon Aug  3 19:42:41 2026
@@ -1,14 +1,14 @@
-$NetBSD: patch-tests_torture.c,v 1.2 2026/07/23 09:25:56 wiz Exp $
+$NetBSD: patch-tests_torture.c,v 1.3 2026/08/03 19:42:41 wiz Exp $
 
 Fix build on NetBSD 8.1: Don't try to use PATH_MAX without #include <limits.h>
 
---- tests/torture.c.orig	2026-07-16 10:56:26.000000000 +0000
+--- tests/torture.c.orig	2026-07-16 10:48:05.000000000 +0000
 +++ tests/torture.c
-@@ -29,6 +29,7 @@
- #include <sys/stat.h>
+@@ -24,6 +24,7 @@
+ #include "config.h"
+ #include "tests_config.h"
  #include <fcntl.h>
- #include <signal.h>
 +#include <limits.h>
- 
- #ifndef _WIN32
- # include <dirent.h>
+ #include <signal.h>
+ #include <stdio.h>
+ #include <stdlib.h>


--_----------=_178578616119420--