[meta-oe][scarthgap][PATCH 0/5] libssh: Fix multiple CVEs
"Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <[email protected]>
| Newsgroups | org.openembedded.lists.openembedded-devel |
|---|---|
| Message-ID | <[email protected]> |
From: Hetvi Thakar <[email protected]> Backport five upstream libssh security fixes to the 0.10.6 recipe on scarthgap: - CVE-2026-59843 - CVE-2026-59844 - CVE-2026-59846 - CVE-2026-59848 - CVE-2026-59850 Carry these as focused backports instead of upgrading libssh because newer releases include API and functional changes outside the security scope. CVE-2026-15370 and CVE-2026-59849 affect libssh >= 0.11.0. CVE-2026-59842 and CVE-2026-59851 affect only libssh 0.12.0 and rely on code or features absent from 0.10.6. NVD correction requests have been submitted for these inaccurate affected-version entries; therefore, no CVE_STATUS entries are added. The individual commits retain the upstream fix provenance and advisory references for each CVE. Testing: - Applied all five patches to libssh 0.10.6 in series order without conflicts or fuzz. - Package build completed successfully. Hetvi Thakar (5): libssh: Fix CVE-2026-59843 libssh: Fix CVE-2026-59844 libssh: Fix CVE-2026-59846 libssh: Fix CVE-2026-59848 libssh: Fix CVE-2026-59850 .../libssh/libssh/CVE-2026-59843.patch | 84 +++ .../libssh/libssh/CVE-2026-59844.patch | 52 ++ .../libssh/libssh/CVE-2026-59846.patch | 87 +++ .../libssh/CVE-2026-59848-regression.patch | 45 ++ .../libssh/libssh/CVE-2026-59848.patch | 684 ++++++++++++++++++ .../libssh/libssh/CVE-2026-59850.patch | 40 + .../recipes-support/libssh/libssh_0.10.6.bb | 6 + 7 files changed, 998 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59843.patch create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59846.patch create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59848-regression.patch create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59848.patch create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch -- 2.35.6