Debian Patches

Status for libssh/0.12.1-1

Patch Description Author Forwarded Bugs Origin Last update
0001-CVE-2026-59843-channels-Fail-when-receiving-max-pack.patch [PATCH 1/2] CVE-2026-59843 channels: Fail when receiving max packet size 0

Do this both for SSH2_MSG_CHANNEL_OPEN and for
SSH2_MSG_CHANNEL_OPEN_CONFIRMATION. Using the
max packet size 0 would lead to an infinite loop
in channel_write_common.

Originally reported by Rinku Das on on 23th February.
Independently reported by Yi Lin on 26th February and
Haruto Kimura on 22nd March.

We do not consider this as a security issue as connecting
to untrusted servers on the internet brings much worse
security consequences than hanging your clinet.

(cherry picked from commit 44b186fa17aff497dae420c59c003222e438103c)		 Pavol Žáčik <pzacik@redhat.com> no 2026-03-06
0002-CVE-2026-59843-tests-Verify-zero-max-packet-size-in-.patch [PATCH 2/2] CVE-2026-59843 tests: Verify zero max packet size in channel open is rejected

Cover both directions with unit tests: a client receiving
SSH2_MSG_CHANNEL_OPEN_CONFIRMATION with a maximum packet size of 0 must
not transition the channel to the open state, and a server receiving
SSH2_MSG_CHANNEL_OPEN with a maximum packet size of 0 must reject the
request. Both come with a positive control using a valid packet size.		 Martin Pitt <mpitt@debian.org> no 2026-07-26
1003-custom-lib-names.patch Allow the buildsystem to overwrite libssh's OUTPUT_NAME. Sebastian Ramacher <s.ramacher@gmx.at> no 2012-06-19
2003-disable-expand_tilde_unix-test.patch Disable torture_path_expand_tilde_unix, its not working well on buildd On buildd, the HOME is set to a non-existing directory, this makes
torture_path_expand_tilde_unix fail

===================================================================		 Laurent Bigonville <bigon@debian.org> not-needed 2024-09-02
2004-install-static-lib.patch Install the static library again Laurent Bigonville <bigon@debian.org> not-needed 2024-09-02

All known versions for source package 'libssh'

Links