Skip to contentSkip to conversation

package/libssh: Security bump to 0.11.4

PATCH Applied Mattias Walström 2 participants 3 messages Feb 28 – Mar 6

lore
Share & tools
lore

Mattias Walström

author
#0 lore raw

PATCH 1/1 package/libssh: Security bump to 0.11.4

CVE-2025-14821: libssh loads configuration files from the C:\etc directory on Windows
CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files
CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
CVE-2026-0967: Specially crafted patterns could cause DoS
CVE-2026-0968: OOB Read in sftp_parse_longname() libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP extensions

Signed-off-by Mattias Walström <[email protected]>
---
 package/libssh/libssh.hash | 2 +-
 package/libssh/libssh.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/libssh/libssh.hash +1 -1
index 1c15d77a45..f259261444 100644
@@ -1,5 +1,5 @@
 # Locally calculated after checking pgp signature
 # https://www.libssh.org/files/0.11/libssh-0.11.3.tar.xz.asc
 # with key 88A228D89B07C2C77D0C780903D5DF8CFDD3E8E7
-sha256  7d8a1361bb094ec3f511964e78a5a4dba689b5986e112afabe4f4d0d6c6125c3  libssh-0.11.3.tar.xz
+sha256  002ac320e3d66c9e100ec6576e3e84aa0c48949efde3bf5b40a2802992297701  libssh-0.11.4.tar.xz
 sha256  1656186e951db1c010a8485481fa94587f7e53a26d24976bef97945ad0c4df5a  COPYING
package/libssh/libssh.mk +1 -1
index 3c7e77a206..56de66d6ea 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 LIBSSH_VERSION_MAJOR = 0.11
-LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).3
+LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).4
 LIBSSH_SOURCE = libssh-$(LIBSSH_VERSION).tar.xz
 LIBSSH_SITE = https://www.libssh.org/files/$(LIBSSH_VERSION_MAJOR)
 LIBSSH_LICENSE = LGPL-2.1
Signature · 6 lines
2.43.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Applied
#1 lore raw
Quoted 11 lines · Mattias Walström

CVE-2025-14821: libssh loads configuration files from the C:\etc directory on Windows
CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files
CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
CVE-2026-0967: Specially crafted patterns could cause DoS
CVE-2026-0968: OOB Read in sftp_parse_longname() libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP extensions

Quoted 1 line
Signed-off-by Mattias Walström <[email protected]>

Applied to master, thanks. For info, I fixed the signature link in the hash file. See:
https://gitlab.com/buildroot.org/buildroot/-/commit/f54e7d710c6dd7d46702304ec8d7ea9e7a8252ec

Best regards,

Julien.
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Applied
#2 lore raw
In reply to Mattias Walström

In reply of:

Quoted 11 lines

CVE-2025-14821: libssh loads configuration files from the C:\etc directory on Windows
CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files
CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
CVE-2026-0967: Specially crafted patterns could cause DoS
CVE-2026-0968: OOB Read in sftp_parse_longname() libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP extensions

Quoted 1 line
Signed-off-by Mattias Walström <[email protected]>

Applied to 2025.02.x & 2025.11.x. Thanks

Quoted 36 lines
---
 package/libssh/libssh.hash | 2 +-
 package/libssh/libssh.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/libssh/libssh.hash +1 -1
index 1c15d77a45..f259261444 100644
@@ -1,5 +1,5 @@
 # Locally calculated after checking pgp signature
 # https://www.libssh.org/files/0.11/libssh-0.11.3.tar.xz.asc
 # with key 88A228D89B07C2C77D0C780903D5DF8CFDD3E8E7
-sha256  7d8a1361bb094ec3f511964e78a5a4dba689b5986e112afabe4f4d0d6c6125c3  libssh-0.11.3.tar.xz
+sha256  002ac320e3d66c9e100ec6576e3e84aa0c48949efde3bf5b40a2802992297701  libssh-0.11.4.tar.xz
 sha256  1656186e951db1c010a8485481fa94587f7e53a26d24976bef97945ad0c4df5a  COPYING
package/libssh/libssh.mk +1 -1
index 3c7e77a206..56de66d6ea 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 LIBSSH_VERSION_MAJOR = 0.11
-LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).3
+LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).4
 LIBSSH_SOURCE = libssh-$(LIBSSH_VERSION).tar.xz
 LIBSSH_SITE = https://www.libssh.org/files/$(LIBSSH_VERSION_MAJOR)
 LIBSSH_LICENSE = LGPL-2.1
Signature · 6 lines
2.43.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot