[Buildroot] [PATCH 4/5] package/libssh2: fix CVE-2026-66034

Backport the fix for CVE-2026-66034.

The publickey subsystem does not sufficiently validate the length of a

server-controlled comment field. A malformed response can therefore

cause an out-of-bounds read.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <[email protected]>

---

Backport to: 2025.02.x

---

...009-publickey-fix-potential-OOB-read.patch | 35 +++++++++++++++++++

package/libssh2/libssh2.mk | 3 ++

2 files changed, 38 insertions(+)

create mode 100644 package/libssh2/0009-publickey-fix-potential-OOB-read.patch

diff --git a/package/libssh2/0009-publickey-fix-potential-OOB-read.patch b/package/libssh2/0009-publickey-fix-potential-OOB-read.patch

new file mode 100644

index 0000000000..96b633f3d1

--- /dev/null

+++ b/package/libssh2/0009-publickey-fix-potential-OOB-read.patch

@@ -0,0 +1,35 @@

+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001

+From: Viktor Szakats <[email protected]>

+Date: Sat, 4 Jul 2026 11:19:49 +0200

+Subject: [PATCH] publickey: fix potential OOB read in

+ `libssh2_publickey_list_fetch()`

+

+Reported-by: Vladimir Eli Tokarev

+Fixes GHSA-w6g9-cpfp-22gc

+

+Closes #2202

+Forwarded: not-needed

+

+CVE: CVE-2026-66034

+Upstream: https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9

+Signed-off-by: Stefan Müller <[email protected]>

+---

+ src/publickey.c | 7 +++++++

+ 1 file changed, 7 insertions(+)

+

+--- a/src/publickey.c

++++ b/src/publickey.c

+@@ -988,6 +988,13 @@

+ }

+

+ if(comment_len) {

++ if(pkey->listFetch_s + comment_len >

++ pkey->listFetch_data + pkey->listFetch_data_len) {

++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,

++ "ListFetch data too short");

++ goto err_exit;

++ }

++

+ list[keys].num_attrs = 1;

+ list[keys].attrs =

+ LIBSSH2_ALLOC(session,

diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk

index a3c0b6a67f..4a4491f0f1 100644

--- a/package/libssh2/libssh2.mk

+++ b/package/libssh2/libssh2.mk

@@ -33,6 +33,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-66032

# 0008-openssl-fix-AES-GCM-bounds-checks.patch

LIBSSH2_IGNORE_CVES += CVE-2026-66033

+# 0009-publickey-fix-potential-OOB-read.patch

+LIBSSH2_IGNORE_CVES += CVE-2026-66034

+

ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)

LIBSSH2_DEPENDENCIES += mbedtls

LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \

--

2.25.1

Freundliche GrüsseStefan MüllerREY TECHNOLOGY AGRütihofstrasse 6, CH-8370 SirnachStefan Müller | CTODirect +41 58 810 04 82 | Support +41 58 810 04 [email protected] | rey-technology.com

https://www.linkedin.com/company/rey-technology https://www.instagram.com/reytechnology_com/ https://teams.microsoft.com/l/chat/0/[email protected]

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot