CVS commit: [pkgsrc-2026Q2] pkgsrc/security/libssh
"Maya Rashish" <[email protected]> Wed, 5 Aug 2026 14:31:38 +0000
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Wed Aug 5 14:31:38 UTC 2026
Modified Files:
pkgsrc/security/libssh [pkgsrc-2026Q2]: Makefile PLIST buildlink3.mk
distinfo
pkgsrc/security/libssh/patches [pkgsrc-2026Q2]: patch-tests_torture.c
Log Message:
Pullup ticket #7212 - requested by taca
security/libssh: Security fix
Revisions pulled up:
- security/libssh/Makefile 1.59
- security/libssh/PLIST 1.24
- security/libssh/buildlink3.mk 1.27
- security/libssh/distinfo 1.36
- security/libssh/patches/patch-tests_torture.c 1.2
---
Module Name: pkgsrc
Committed By: wiz
Date: Thu Jul 23 09:25:56 UTC 2026
Modified Files:
pkgsrc/security/libssh: Makefile PLIST buildlink3.mk distinfo
pkgsrc/security/libssh/patches: patch-tests_torture.c
Log Message:
libssh: update to 0.11.5.
Follow upstream version numbering again.
version 0.11.5 (released 2026-07-21)
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59843: Denial of service via zero advertised channel packet size
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Bugfixes:
* Fix multiple memory leaks, null checks, and error checks
* Validate peer public key in DH key exchange
* Avoid remote window overflow
* Avoid off-by-one overflow during kbdint authentication
* Avoid logging uninitialized sequence numbers
* Avoid double conversion of SFTP version number
* Send correct SFTP server version number
* Avoid handling repeated SFTP INIT messages
* Harmonize return values from SFTP server callbacks
To generate a diff of this commit:
cvs rdiff -u -r1.57 -r1.57.2.1 pkgsrc/security/libssh/Makefile
cvs rdiff -u -r1.23 -r1.23.4.1 pkgsrc/security/libssh/PLIST
cvs rdiff -u -r1.26 -r1.26.10.1 pkgsrc/security/libssh/buildlink3.mk
cvs rdiff -u -r1.35 -r1.35.4.1 pkgsrc/security/libssh/distinfo
cvs rdiff -u -r1.1 -r1.1.52.1 \
pkgsrc/security/libssh/patches/patch-tests_torture.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 4.4 KB)
Modified files:
Index: pkgsrc/security/libssh/Makefile
diff -u pkgsrc/security/libssh/Makefile:1.57 pkgsrc/security/libssh/Makefile:1.57.2.1
--- pkgsrc/security/libssh/Makefile:1.57 Thu Jun 11 07:21:25 2026
+++ pkgsrc/security/libssh/Makefile Wed Aug 5 14:31:37 2026
@@ -1,14 +1,8 @@
-# $NetBSD: Makefile,v 1.57 2026/06/11 07:21:25 wiz Exp $
-#
-# history: upstream renamed 0.11 to 0.1.1;
-# we have to use the old-style convention so that version compares work.
-
-VER= 0.11.4
-DISTNAME= libssh-${VER}
-PKGNAME= libssh-0.114
-PKGREVISION= 1
+# $NetBSD: Makefile,v 1.57.2.1 2026/08/05 14:31:37 maya Exp $
+
+DISTNAME= libssh-0.11.5
CATEGORIES= security
-MASTER_SITES= https://www.libssh.org/files/${VER:R}/
+MASTER_SITES= https://www.libssh.org/files/${PKGVERSION_NOREV:R}/
EXTRACT_SUFX= .tar.xz
MAINTAINER= [email protected]
Index: pkgsrc/security/libssh/PLIST
diff -u pkgsrc/security/libssh/PLIST:1.23 pkgsrc/security/libssh/PLIST:1.23.4.1
--- pkgsrc/security/libssh/PLIST:1.23 Tue Mar 17 19:33:33 2026
+++ pkgsrc/security/libssh/PLIST Wed Aug 5 14:31:37 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.23 2026/03/17 19:33:33 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.23.4.1 2026/08/05 14:31:37 maya Exp $
include/libssh/callbacks.h
include/libssh/legacy.h
include/libssh/libssh.h
@@ -13,5 +13,5 @@ lib/cmake/libssh/libssh-config-version.c
lib/cmake/libssh/libssh-config.cmake
lib/libssh.so
lib/libssh.so.4
-lib/libssh.so.4.10.4
+lib/libssh.so.4.10.5
lib/pkgconfig/libssh.pc
Index: pkgsrc/security/libssh/buildlink3.mk
diff -u pkgsrc/security/libssh/buildlink3.mk:1.26 pkgsrc/security/libssh/buildlink3.mk:1.26.10.1
--- pkgsrc/security/libssh/buildlink3.mk:1.26 Sat Apr 19 07:58:22 2025
+++ pkgsrc/security/libssh/buildlink3.mk Wed Aug 5 14:31:37 2026
@@ -1,12 +1,12 @@
-# $NetBSD: buildlink3.mk,v 1.26 2025/04/19 07:58:22 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.26.10.1 2026/08/05 14:31:37 maya Exp $
BUILDLINK_TREE+= libssh
.if !defined(LIBSSH_BUILDLINK3_MK)
LIBSSH_BUILDLINK3_MK:=
-BUILDLINK_API_DEPENDS.libssh+= libssh>=0.54
-BUILDLINK_ABI_DEPENDS.libssh+= libssh>=0.111nb1
+BUILDLINK_API_DEPENDS.libssh+= libssh>=0.11.5<0.100
+BUILDLINK_ABI_DEPENDS.libssh?= libssh>=0.11.5
BUILDLINK_PKGSRCDIR.libssh?= ../../security/libssh
pkgbase := libssh
Index: pkgsrc/security/libssh/distinfo
diff -u pkgsrc/security/libssh/distinfo:1.35 pkgsrc/security/libssh/distinfo:1.35.4.1
--- pkgsrc/security/libssh/distinfo:1.35 Tue Mar 17 19:33:33 2026
+++ pkgsrc/security/libssh/distinfo Wed Aug 5 14:31:37 2026
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.35 2026/03/17 19:33:33 bsiegert Exp $
+$NetBSD: distinfo,v 1.35.4.1 2026/08/05 14:31:37 maya Exp $
-BLAKE2s (libssh-0.11.4.tar.xz) = d25e69defcccff547fac66700f8fd30d1af90c2a65a4be19d2be4ffad3ddba56
-SHA512 (libssh-0.11.4.tar.xz) = 00c7e1317dcca8feab07eb3d6feb7bbc74c563149173d439d618f431386c4ca1d6f258567ef0599f08275a3a165c04105568f55e6ed7f0fe1a88382e2ebdc850
-Size (libssh-0.11.4.tar.xz) = 626652 bytes
+BLAKE2s (libssh-0.11.5.tar.xz) = 8680a65333de0083ca40296c88ccca0c937b77821564353398ec0ed8995ceb7a
+SHA512 (libssh-0.11.5.tar.xz) = bf565de9a429d173c88a4b182c37efe242392751441e84bc30335ae95eeeb264fc2783744fbdc80267bd76a0cbb96ebef04b9d9b7f4a76890974e6ee05c14257
+Size (libssh-0.11.5.tar.xz) = 629716 bytes
SHA1 (patch-CompilerChecks.cmake) = 8a650be5b69e956a0a54f54b71c4927ce685b8ca
SHA1 (patch-examples_sshd__direct-tcpip.c) = 62de8625d58dbc03c38b0eb23f6e7f20a46e91de
SHA1 (patch-tests_CMakeLists.txt) = b5baa8db2161d3f1c7aab317b2919de5dbca6e6a
-SHA1 (patch-tests_torture.c) = 2c70e9d827f15ec36a62e0d0f5dd98774f24f79e
+SHA1 (patch-tests_torture.c) = 39831812d1b7d16eaf0f6e4b867f4c453278afbd
Index: pkgsrc/security/libssh/patches/patch-tests_torture.c
diff -u pkgsrc/security/libssh/patches/patch-tests_torture.c:1.1 pkgsrc/security/libssh/patches/patch-tests_torture.c:1.1.52.1
--- pkgsrc/security/libssh/patches/patch-tests_torture.c:1.1 Mon Jan 6 12:04:13 2020
+++ pkgsrc/security/libssh/patches/patch-tests_torture.c Wed Aug 5 14:31:37 2026
@@ -1,8 +1,8 @@
-$NetBSD: patch-tests_torture.c,v 1.1 2020/01/06 12:04:13 pho Exp $
+$NetBSD: patch-tests_torture.c,v 1.1.52.1 2026/08/05 14:31:37 maya Exp $
Fix build on NetBSD 8.1: Don't try to use PATH_MAX without #include <limits.h>
---- tests/torture.c.orig 2020-01-06 12:01:16.440174806 +0000
+--- tests/torture.c.orig 2026-07-16 10:56:26.000000000 +0000
+++ tests/torture.c
@@ -29,6 +29,7 @@
#include <sys/stat.h>