linux/meta-openembedded.git/meta-oe/recipes-support/libssh, branch scarthgap

libssh: set status for CVE-2025-14821

2026-05-21T03:27:48+00:00

The vulnerability is Windows-specific and depends on loading configuration from C:\etc, which does not apply to Linux/Yocto builds Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-14821 https://github.com/advisories/GHSA-5jf9-8f86-jhvw https://www.libssh.org/security/advisories/CVE-2025-14821.txt Signed-off-by: Sudhir Dumbhare Signed-off-by: Anuj Mittal

libssh: Fix CVE-2026-0965

2026-04-29T04:44:29+00:00

Backport the patch [1] as mentioned in [2] [1] https://git.libssh.org/projects/libssh.git/commit/?id=bf390a042623e02abc8f421c4c5fadc0429a8a76 [2] https://security-tracker.debian.org/tracker/CVE-2026-0965 Ptests passed: root@qemux86:~# ptest-runner libssh START: ptest-runner 2026-04-28T04:44 BEGIN: /usr/lib/libssh/ptest ... ... DURATION: 269 END: /usr/lib/libssh/ptest 2026-04-28T04:49 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libssh: patch CVE-2026-0967

2026-04-29T04:44:29+00:00

Backport patch [1] as mentioned in [2] [1] https://git.libssh.org/projects/libssh.git/commit/?id=6d74aa6138895b3662bade9bd578338b0c4f8a15 [2] https://security-tracker.debian.org/tracker/CVE-2026-0967 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libssh: patch CVE-2026-0968

2026-04-29T04:44:29+00:00

Backport patches [1] and [2] as mentioned in [3] [1] https://git.libssh.org/projects/libssh.git/commit/?id=796d85f786dff62bd4bcc4408d9b7bbc855841e9 [2] https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03 [3] https://security-tracker.debian.org/tracker/CVE-2026-0968 Certain functions from sftp.c were moved to a new file sftp_common.c in version 0.11.0 by following commit: https://git.libssh.org/projects/libssh.git/commit/src/sftp_common.c?id=c3e03ab4651e4f3382e3a51c0273ade894f0c48a This is the backport of the changes using the original file sftp.c Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libssh: Fix CVE-2026-0966

2026-04-03T09:30:47+00:00

Pick commits according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-0966 [2] https://www.libssh.org/security/advisories/CVE-2026-0966.txt Signed-off-by: Vijay Anusuri Signed-off-by: Anuj Mittal

libssh: Fix CVE-2026-0964

2026-04-03T09:30:46+00:00

Pick commits according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-0964 [2] https://www.libssh.org/security/advisories/CVE-2026-0964.txt Signed-off-by: Vijay Anusuri Signed-off-by: Anuj Mittal

libssh: Fix CVE-2026-3731

2026-03-24T03:22:09+00:00

Pick commits according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-3731 [2] https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt Signed-off-by: Vijay Anusuri Signed-off-by: Anuj Mittal

libssh: Fix CVE-2025-8277

2025-11-12T05:14:37+00:00

Upstream-Commits: https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=87db2659ec608a977a63eea529f17b9168388d73 & https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=266174a6d36687b65cf90174f06af90b8b27c65f & https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=8e4d67aa9eda455bfad9ac610e54b7a548d0aa08 & https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=1c763e29d138db87665e98983f468d2dd0f286c1 The changes made to the file src/ecdh_crypto.c are excluded, present in the commit 266174a6d36687b65cf90174f06af90b8b27c65. The relevant changes in `ecdh_crypto.c` are located within the function `static ssh_string ssh_ecdh_generate`. This function, however, is not present in the `libssh-0.10.6` version. It was introduced in `libssh` version 0.11 by the commit `https://git.libssh.org/projects/libssh.git/commit/src/ecdh_crypto.c?h=stable-0.11&id=1eb3df5254a4348eae6edbc8a2bf08fef4015897`. Consequently, these changes cannot be directly applied to the `libssh-0.10.6` version. This aligns with the approach taken by other distributions, as Suse also did not backport the `ecdh_crypto.c` file changes in their `libssh-0.10.6-3.1.src.rpm` package, which is available at `https://cdimage.debian.org/mirror/opensuse.org/distribution/leap-micro/6.0/product/repo/openSUSE-Leap-Micro-6.0-x86_64-Media3/src/libssh-0.10.6-3.1.src.rpm`. Signed-off-by: Vijay Anusuri Signed-off-by: Anuj Mittal

libssh 0.10.6: Fix CVE-2025-8114

2025-09-23T02:08:04+00:00

Upstream Repository: https://git.libssh.org/projects/libssh.git/ Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-8114 Type: Security Fix CVE: CVE-2025-8114 Score: 4.7 Patch: https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb Signed-off-by: Anil Dongare Signed-off-by: Anuj Mittal

libssh: fix CVE-2025-5987

2025-09-23T01:59:05+00:00

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5987 Upstream-patch: https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=90b4845e0c98574bbf7bea9e97796695f064bf57 Signed-off-by: Divya Chellam Signed-off-by: Anuj Mittal