[meta-oe][scarthgap][PATCH 2/2] libssh: set status for CVE-2026-59842
Hitendra Prajapati <[email protected]>
| Newsgroups | org.openembedded.lists.openembedded-devel |
|---|---|
| Message-ID | <[email protected]> |
Analysis: - CVE-2026-59842 affects information disclosure via short GSSAPI Curve25519 public key. - This vulnerable code is not present in the current libssh 0.10.6. - Hence ignoring the CVE for this version. Reference: 1. https://www.cve.org/CVERecord?id=CVE-2026-59842 2. https://www.libssh.org/security/advisories/CVE-2026-59842.txt 3. https://security-tracker.debian.org/tracker/CVE-2026-59842 Signed-off-by: Hitendra Prajapati <[email protected]> --- meta-oe/recipes-support/libssh/libssh_0.10.6.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 13e01ff9fc..63854ef5fd 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -72,3 +72,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: only affects Windows due to loading configuration from C:\etc" #Reference: https://www.libssh.org/security/advisories/CVE-2026-15370.txt CVE_STATUS[CVE-2026-15370] = "fixed-version: vulnerable SFTP server longname construction handling was introduced in 0.11.0 and is not present in 0.10.6" +CVE_STATUS[CVE-2026-59842] = "fixed-version: vulnerable information disclosure via short GSSAPI Curve25519 public key in 0.12.0 and is not present in 0.10.6" -- 2.50.1