[Buildroot] [git commit] package/libssh2: fix CVE-2026-66034
Julien Olivain via buildroot <[email protected]>
| Newsgroups | net.busybox.buildroot |
|---|---|
| Message-ID | <[email protected]> |
commit: https://gitlab.com/buildroot.org/buildroot/-/commit/58581deeca7768271056e9a1461362a2a698105b branch: https://gitlab.com/buildroot.org/buildroot/-/tree/master Backport the fix for CVE-2026-66034. The publickey subsystem does not sufficiently validate the length of a server-controlled comment field. A malformed response can therefore cause an out-of-bounds read. Use Debian's libssh2 1.11.1 backport of the upstream fix. Signed-off-by: Stefan Müller <[email protected]> [Julien: add links to Debian patches] Signed-off-by: Julien Olivain <[email protected]> --- .../0009-publickey-fix-potential-OOB-read.patch | 36 ++++++++++++++++++++++ package/libssh2/libssh2.mk | 3 ++ 2 files changed, 39 insertions(+) diff --git a/package/libssh2/0009-publickey-fix-potential-OOB-read.patch b/package/libssh2/0009-publickey-fix-potential-OOB-read.patch new file mode 100644 index 0000000000..91cd42f640 --- /dev/null +++ b/package/libssh2/0009-publickey-fix-potential-OOB-read.patch @@ -0,0 +1,36 @@ +From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <[email protected]> +Date: Sat, 4 Jul 2026 11:19:49 +0200 +Subject: [PATCH] publickey: fix potential OOB read in + `libssh2_publickey_list_fetch()` + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-w6g9-cpfp-22gc + +Closes #2202 +Forwarded: not-needed + +CVE: CVE-2026-66034 +Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66034.patch/ +Upstream: https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9 +Signed-off-by: Stefan Müller <[email protected]> +--- + src/publickey.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -988,6 +988,13 @@ + } + + if(comment_len) { ++ if(pkey->listFetch_s + comment_len > ++ pkey->listFetch_data + pkey->listFetch_data_len) { ++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "ListFetch data too short"); ++ goto err_exit; ++ } ++ + list[keys].num_attrs = 1; + list[keys].attrs = + LIBSSH2_ALLOC(session, diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk index a3c0b6a67f..4a4491f0f1 100644 --- a/package/libssh2/libssh2.mk +++ b/package/libssh2/libssh2.mk @@ -33,6 +33,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-66032 # 0008-openssl-fix-AES-GCM-bounds-checks.patch LIBSSH2_IGNORE_CVES += CVE-2026-66033 +# 0009-publickey-fix-potential-OOB-read.patch +LIBSSH2_IGNORE_CVES += CVE-2026-66034 + ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y) LIBSSH2_DEPENDENCIES += mbedtls LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \ _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot