Debian Patches

Status for libssh/0.10.6-0+deb12u3

Patch Description Author Forwarded Bugs Origin Last update
0001-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch [PATCH 1/2] Fix regression in IPv6 addresses in hostname parsing
(cherry picked from commit 4f997aee7c7d7ea346b3e8ba505da0b7601ff318)		 Jakub Jelen <jjelen@redhat.com> no 2023-12-22
0002-tests-Increase-test-coverage-for-IPv6-address-parsin.patch [PATCH 2/2] tests: Increase test coverage for IPv6 address parsing as hostnames

This was an issue in cockpit:

https://github.com/cockpit-project/cockpit/issues/19772

(cherry picked from commit 6f6e453d7b0ad4ee6a6f6a1c96a9a6b27821410d)		 Jakub Jelen <jjelen@redhat.com> no 2023-12-22
CVE-2026-0965.patch CVE-2026-0965 config: Do not attempt to read non-regular and too large configuration files

Changes also the reading of known_hosts to use the new helper function

(cherry picked from commit a5eb30dbfd8f3526b2d04bd9f0a3803b665f5798)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=bf390a042623e02abc8f421c4c5fadc0429a8a76 2025-12-11
CVE-2026-0966.patch CVE-2026-0966 misc: Avoid heap buffer underflow in ssh_get_hexa

(cherry picked from commit 417a095e6749a1f3635e02332061edad3c6a3401)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=6ba5ff1b7b1547a59f750fbc06b89737b7456117 2026-01-08
0003-CVE-2025-4877-base64-Prevent-integer-overflow-and-po.patch [PATCH 3/8] CVE-2025-4877 base64: Prevent integer overflow and potential OOB

Set maximum input to 256MB to have safe margin to the 1GB trigger point
for 32b arch.

The OOB should not be reachable by any internal code paths as most of
the buffers and strings we use as input for this operation already have
similar limit and none really allows this much of data.

(cherry picked from commit 00f09acbec55962839fc7837ef14c56fb8fbaf72)		 Jakub Jelen <jjelen@redhat.com> no 2025-04-15
0004-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch [PATCH 4/8] CVE-2025-5318: sftpserver: Fix possible buffer overrun

(cherry-picked from commit 5f4ffda88770f95482f)		 Jakub Jelen <jjelen@redhat.com> no 2025-04-22
0005-CVE-2025-4878-legacy-Properly-check-return-value-to-.patch [PATCH 5/8] CVE-2025-4878 legacy: Properly check return value to avoid NULL pointer dereference


(cherry-picked from commit b35ee876adc92a208)		 Jakub Jelen <jjelen@redhat.com> no 2025-04-28
0006-CVE-2025-5351-pki_crypto-Avoid-double-free-on-low-me.patch [PATCH 6/8] CVE-2025-5351 pki_crypto: Avoid double-free on low-memory conditions


(cherry-picked from commit 6ddb730a273389838)		 Jakub Jelen <jjelen@redhat.com> no 2025-05-06
0007-CVE-2025-5987-libcrypto-Correctly-detect-failures-of.patch [PATCH 7/8] CVE-2025-5987 libcrypto: Correctly detect failures of chacha initialization


(cherry-picked from commit 90b4845e0c98574bb)		 Jakub Jelen <jjelen@redhat.com> no 2025-05-06
0008-CVE-2025-5372-libgcrypto-Simplify-error-checking-and.patch [PATCH 8/8] CVE-2025-5372 libgcrypto: Simplify error checking and handling of return codes in ssh_kdf()


(cherry-picked from commit a9d8a3d44829cf9182b)		 Jakub Jelen <jjelen@redhat.com> no 2025-05-14
1003-custom-lib-names.patch Allow the buildsystem to overwrite libssh's OUTPUT_NAME. Sebastian Ramacher <s.ramacher@gmx.at> no 2012-06-19
2003-disable-expand_tilde_unix-test.patch Disable torture_path_expand_tilde_unix, its not working well on buildd On buildd, the HOME is set to a non-existing directory, this makes
torture_path_expand_tilde_unix fail

===================================================================		 Laurent Bigonville <bigon@debian.org> not-needed
2004-install-static-lib.patch Install the static library again Laurent Bigonville <bigon@debian.org> not-needed
CVE-2025-8114.patch CVE-2025-8114: Fix NULL pointer dereference after allocation failure Andreas Schneider <asn@cryptomilk.org> no 2025-08-06
CVE-2025-8277-1.patch CVE-2025-8277: packet: Adjust packet filter to work when DH-GEX is guessed wrongly

(cherry picked from commit 4310a696f2d632c6742678077d703d9b9ff3bc0e)		 Jakub Jelen <jjelen@redhat.com> no 2025-08-05
CVE-2025-8277-2.patch CVE-2025-8277: Fix memory leak of unused ephemeral key pair after client's wrong KEX guess

(cherry picked from commit ccff22d3787c1355b3f0dcd09fe54d90acc55bf1)		 Francesco Rollo <eferollo@gmail.com> no 2025-07-24
CVE-2025-8277-3.patch CVE-2025-8277: ecdh: Free previously allocated pubkeys
(cherry picked from commit c9d95ab0c7a52b231bcec09afbea71944ed0d852)		 Jakub Jelen <jjelen@redhat.com> no 2025-08-06
CVE-2025-8277-4.patch CVE-2025-8277: mbedtls: Avoid leaking ecdh keys
(cherry picked from commit ffed80f8c078122990a4eba2b275facd56dd43e0)		 Jakub Jelen <jjelen@redhat.com> no 2025-08-06
CVE-2026-0964.patch CVE-2026-0964 scp: Reject invalid paths received through scp
(cherry picked from commit daa80818f89347b4d80b0c5b80659f9a9e55e8cc)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=a5e4b12090b0c939d85af4f29280e40c5b6600aa 2025-12-22
CVE-2026-0967.patch CVE-2026-0967 match: Avoid recursive matching (ReDoS)
The specially crafted patterns (from configuration files) could cause
exhaustive search or timeouts.

Previous attempts to fix this by limiting recursion to depth 16 avoided
stack overflow, but not timeouts. This is due to the backtracking,
which caused the exponential time complexity O(N^16) of existing algorithm.

This is code comes from the same function from OpenSSH, where this code
originates from, which is not having this issue (due to not limiting the number
of recursion), but will also easily exhaust stack due to unbound recursion:

https://github.com/openssh/openssh-portable/commit/05bcd0cadf160fd4826a2284afa7cba6ec432633

This is an attempt to simplify the algorithm by preventing the backtracking
to previous wildcard, which should keep the same behavior for existing inputs
while reducing the complexity to linear O(N*M).

This fixes the long-term issue we had with fuzzing as well as recently reported
security issue by Kang Yang.

(cherry picked from commit a411de5ce806e3ea24d088774b2f7584d6590b5f)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=6d74aa6138895b3662bade9bd578338b0c4f8a15 2025-12-17
CVE-2026-59843.patch CVE-2026-59843 channels: Fail when receiving max packet size 0

Do this both for SSH2_MSG_CHANNEL_OPEN and for
SSH2_MSG_CHANNEL_OPEN_CONFIRMATION. Using the
max packet size 0 would lead to an infinite loop
in channel_write_common.

Originally reported by Rinku Das on on 23th February.
Independently reported by Yi Lin on 26th February and
Haruto Kimura on 22nd March.

We do not consider this as a security issue as connecting
to untrusted servers on the internet brings much worse
security consequences than hanging your clinet.

(cherry picked from commit 44b186fa17aff497dae420c59c003222e438103c)		 Pavol Žáčik <pzacik@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=687ef1c44b646b9db0b1c6e8f987edb7c9e4d919 2026-03-06
CVE-2026-59843-tests.patch CVE-2026-59843 tests: Verify zero max packet size in channel open is rejected

Cover both directions with unit tests: a client receiving
SSH2_MSG_CHANNEL_OPEN_CONFIRMATION with a maximum packet size of 0 must
not transition the channel to the open state, and a server receiving
SSH2_MSG_CHANNEL_OPEN with a maximum packet size of 0 must reject the
request. Both come with a positive control using a valid packet size.		 Martin Pitt <mpitt@debian.org> no https://git.libssh.org/projects/libssh.git/commit/?id=7d7c3a04a25b0c86bb402627d3b6918232243445 2026-07-26
CVE-2026-59845.patch CVE-2026-59845 socket: Properly check fork() return code
During execution of proxy command, when fork() fails, its return value
is stored in pid and when the parent process attempts to kill it,
it sends the kill signal to all processes the calling application has
access to (except for init).

This caused nard to debug issues when the system under the load was hitting
fork failures, which resulted in killing of all the system processes
(of given user).

Reported and first patch iteration provided by: Halil Oktay (oblivionsage).

This code missing fork return value check is in libssh since 2010
(f31a14b7932ef4cc165ddd8f1f1a5b23eb21beb3), but this issue is exploitable only
since libssh 0.9.0 as previously there was no implementation of killing
ProxyCommand children.

(cherry picked from commit 92b6fb9c5e2d1606e8f809fd884ab6dd4d3b7d45)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=1afacdb430de7441c81d11a8c0ef8a36de78e960 2026-03-26
CVE-2026-59847-1.patch CVE-2026-59847 libcrypto: Fix tag verification of AES-GCM ciphers

EVP_DecryptFinal() returns 0 errors, which was wrongly checked since
its introduction.

Reported by Ben Smyth discuss@bensmyth.com

(cherry picked from commit 6d6cb6cb4d1684bb3f2b9fd23f3635e79d1e5495)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=c7080ffcc139c3c1833c34ccaa8683efc562e5f9 2026-05-15
CVE-2026-59847-2.patch CVE-2026-59847 libcrypto: Fix symmetric issue during encryption

(cherry picked from commit a5173c6ad249f7960bc7c1cc75a6a05ead8e3eba)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=06c6082df966ef69db19387cf2064fa053fca1ed 2026-05-18
CVE-2026-59850.patch CVE-2026-59850 channels: Avoid processing DATA packets on closed channels

(cherry picked from commit a8a3fa352bb5213e08a35e4494c6e44360e2e38a)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2 2026-07-01
CVE-2026-59850-tests.patch CVE-2026-59850 tests: Verify sending data after close does not trigger callbacks

(cherry picked from commit 8784a20c5910793eba338b68d0acca177984bd1a)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=33723f5a5eda8860c4257ad6fdb5be9943c57f91 2026-07-01
CVE-2026-59846.patch CVE-2026-59846 Block shell metacharacters from usernames
When an attacker could sneak the dollar sign or backslash into the username
expanded for example in proxy command, it can result in printing environment
variables that might contain secrets.

This is a fixup of CVE-2023-6004 which fixed this for hostnames, but these
two metacharacters were left out from the username filter.

This keeps the list in one place to simplify maintenance.

(cherry picked from commit 6309df220e3431deb41946f892f4bb5af8b59dba)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=56ce3c193eb06af5bf3b07ec0b4c7308b5c72130 2026-04-02
CVE-2026-0968.patch CVE-2026-0968: sftp: Sanitize input handling in sftp_parse_longname()

(cherry picked from commit 20856f44c146468c830da61dcbbbaa8ce71e390b)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=796d85f786dff62bd4bcc4408d9b7bbc855841e9 2025-12-22
CVE-2026-0968-tests.patch CVE-2026-0968 tests: Reproducer for invalid longname data
(cherry picked from commit 90a5d8f47399e8db61b56793cd21476ff6a528e0)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03 2025-12-22
CVE-2026-3731.patch sftp: Fix out-of-bound read from sftp extensions
(cherry picked from commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=f80670a7aba86cbb442c9b115c9eaf4ca04601b8 2025-12-11
CVE-2026-3731-tests.patch Reproducer for out of bounds read of SFTP extensions
(cherry picked from commit b90b7f24517efa7ab21506db9379aa3dce9fee7d)		 Jakub Jelen <jjelen@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=02c6f5f7ec8629a7cff6a28cde9701ab10304540 2025-12-11
CVE-2026-59844.patch CVE-2026-59844 sftpserver: cap accepted values of len in SSH_FXP_READ

The client-provided length is directly used in
a malloc in process_read(), so not restricting it
leads to allocations bounded only by UINT32_MAX.

The new cap is the same as the one currently used
by OpenSSH.

(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627)		 Pavol Žáčik <pzacik@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9 2026-03-06
CVE-2026-59848.patch CVE-2026-59848 sftp: handle responses with unknown request IDs

This adds a new field to sftp_session_struct,
containing a list of outstanding request IDs.
An ID is added to the list when a request
is constructed and removed when the corresponding
request is received. If a client receives a response
with an unknown request ID, it reports an error.

Storing responses with unknown request IDs in
the response queue could be abused by a malicious
SFTP server which could deplete client memory
this way.

(cherry picked from commit 26147eb4767937c797f97ff3b1b1663384232417)		 Pavol Žáčik <pzacik@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=a30a51003205744c10ba4439306f555206ae8497 2026-06-01
CVE-2026-59848-tests.patch CVE-2026-59848 sftp: handle responses with unknown request IDs

tests/client/torture_sftp_request_id.c is the regression test from
this commit.

(cherry picked from commit 26147eb4767937c797f97ff3b1b1663384232417)		 Pavol Žáčik <pzacik@redhat.com> no https://git.libssh.org/projects/libssh.git/commit/?id=a30a51003205744c10ba4439306f555206ae8497 2026-06-01

All known versions for source package 'libssh'

Links