summaryrefslogtreecommitdiffstats
path: root/meta-oe
diff options
context:
space:
mode:
authorDeepak Rathore <deeratho@cisco.com>2026-04-06 04:54:54 -0700
committerAnuj Mittal <anuj.mittal@oss.qualcomm.com>2026-04-24 21:13:20 +0530
commitf516c3f209391077cebb43439e1c3a7eba26111f (patch)
treee0fb9b2255debd7c8003c926e3d7a85ce877adf4 /meta-oe
parent2d95f187bd79c561659a05b79bd3e317deb5591a (diff)
downloadmeta-openembedded-f516c3f209391077cebb43439e1c3a7eba26111f.tar.gz
libssh: Fix CVE-2026-0968
Pick the patch [1] and [2] as mentioned in [3] [1] https://git.libssh.org/projects/libssh.git/commit/?id=796d85f786dff62bd4bcc4408d9b7bbc855841e9 [2] https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03 [3] https://security-tracker.debian.org/tracker/CVE-2026-0968 Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Diffstat (limited to 'meta-oe')
-rw-r--r--meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p1.patch64
-rw-r--r--meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p2.patch132
-rw-r--r--meta-oe/recipes-support/libssh/libssh_0.11.3.bb2
3 files changed, 198 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p1.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p1.patch
new file mode 100644
index 0000000000..97ae88b2be
--- /dev/null
+++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p1.patch
@@ -0,0 +1,64 @@
1From 14a1c80ce06cd2c3e4798ec08b25a55ddaf95076 Mon Sep 17 00:00:00 2001
2From: Jakub Jelen <jjelen@redhat.com>
3Date: Mon, 22 Dec 2025 20:59:11 +0100
4Subject: [PATCH 1/4] CVE-2026-0968: sftp: Sanitize input handling in
5 sftp_parse_longname()
6
7CVE: CVE-2026-0968
8Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=796d85f786dff62bd4bcc4408d9b7bbc855841e9]
9
10Signed-off-by: Jakub Jelen <jjelen@redhat.com>
11Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
12(cherry picked from commit 20856f44c146468c830da61dcbbbaa8ce71e390b)
13(cherry picked from commit 796d85f786dff62bd4bcc4408d9b7bbc855841e9)
14Signed-off-by: Deepak Rathore <deeratho@cisco.com>
15---
16 src/sftp_common.c | 16 +++++++++++++---
17 1 file changed, 13 insertions(+), 3 deletions(-)
18
19diff --git a/src/sftp_common.c b/src/sftp_common.c
20index 13512b8d..b05597d8 100644
21--- a/src/sftp_common.c
22+++ b/src/sftp_common.c
23@@ -461,16 +461,21 @@ static char * sftp_parse_longname(const char *longname,
24 const char *p, *q;
25 size_t len, field = 0;
26
27+ if (longname == NULL || longname_field < SFTP_LONGNAME_PERM ||
28+ longname_field > SFTP_LONGNAME_NAME) {
29+ return NULL;
30+ }
31+
32 p = longname;
33 /*
34 * Find the beginning of the field which is specified
35 * by sftp_longname_field_e.
36 */
37- while (field != longname_field) {
38+ while (*p != '\0' && field != longname_field) {
39 if (isspace(*p)) {
40 field++;
41 p++;
42- while (*p && isspace(*p)) {
43+ while (*p != '\0' && isspace(*p)) {
44 p++;
45 }
46 } else {
47@@ -478,8 +483,13 @@ static char * sftp_parse_longname(const char *longname,
48 }
49 }
50
51+ /* If we reached NULL before we got our field fail */
52+ if (field != longname_field) {
53+ return NULL;
54+ }
55+
56 q = p;
57- while (! isspace(*q)) {
58+ while (*q != '\0' && !isspace(*q)) {
59 q++;
60 }
61
62--
632.51.0
64
diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p2.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p2.patch
new file mode 100644
index 0000000000..6de0d6cb3d
--- /dev/null
+++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0968_p2.patch
@@ -0,0 +1,132 @@
1From 5ad81f0514bf547055fd17dd4ca05121f1e512c9 Mon Sep 17 00:00:00 2001
2From: Jakub Jelen <jjelen@redhat.com>
3Date: Mon, 22 Dec 2025 21:00:03 +0100
4Subject: [PATCH 2/4] CVE-2026-0968 tests: Reproducer for invalid longname data
5
6CVE: CVE-2026-0968
7Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03]
8
9Signed-off-by: Jakub Jelen <jjelen@redhat.com>
10Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
11(cherry picked from commit 90a5d8f47399e8db61b56793cd21476ff6a528e0)
12(cherry picked from commit 212121971fb26e1e00b72bd5402c0454a4d84c03)
13Signed-off-by: Deepak Rathore <deeratho@cisco.com>
14---
15 tests/unittests/CMakeLists.txt | 7 +++
16 tests/unittests/torture_unit_sftp.c | 86 +++++++++++++++++++++++++++++
17 2 files changed, 93 insertions(+)
18 create mode 100644 tests/unittests/torture_unit_sftp.c
19
20diff --git a/tests/unittests/CMakeLists.txt b/tests/unittests/CMakeLists.txt
21index 79f3856c..53478af9 100644
22--- a/tests/unittests/CMakeLists.txt
23+++ b/tests/unittests/CMakeLists.txt
24@@ -98,6 +98,13 @@ if (UNIX AND NOT WIN32)
25 endif (WITH_SERVER)
26 endif (UNIX AND NOT WIN32)
27
28+if (WITH_SFTP)
29+ set(LIBSSH_UNIT_TESTS
30+ ${LIBSSH_UNIT_TESTS}
31+ torture_unit_sftp
32+ )
33+endif (WITH_SFTP)
34+
35 foreach(_UNIT_TEST ${LIBSSH_UNIT_TESTS})
36 add_cmocka_test(${_UNIT_TEST}
37 SOURCES ${_UNIT_TEST}.c
38diff --git a/tests/unittests/torture_unit_sftp.c b/tests/unittests/torture_unit_sftp.c
39new file mode 100644
40index 00000000..12940039
41--- /dev/null
42+++ b/tests/unittests/torture_unit_sftp.c
43@@ -0,0 +1,86 @@
44+#include "config.h"
45+
46+#include "sftp_common.c"
47+#include "torture.h"
48+
49+#define LIBSSH_STATIC
50+
51+static void test_sftp_parse_longname(void **state)
52+{
53+ const char *lname = NULL;
54+ char *value = NULL;
55+
56+ /* state not used */
57+ (void)state;
58+
59+ /* Valid example from SFTP draft, page 18:
60+ * https://datatracker.ietf.org/doc/draft-spaghetti-sshm-filexfer/
61+ */
62+ lname = "-rwxr-xr-x 1 mjos staff 348911 Mar 25 14:29 t-filexfer";
63+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
64+ assert_string_equal(value, "-rwxr-xr-x");
65+ free(value);
66+ value = sftp_parse_longname(lname, SFTP_LONGNAME_OWNER);
67+ assert_string_equal(value, "mjos");
68+ free(value);
69+ value = sftp_parse_longname(lname, SFTP_LONGNAME_GROUP);
70+ assert_string_equal(value, "staff");
71+ free(value);
72+ value = sftp_parse_longname(lname, SFTP_LONGNAME_SIZE);
73+ assert_string_equal(value, "348911");
74+ free(value);
75+ /* This function is broken further as the date contains space which breaks
76+ * the parsing altogether */
77+ value = sftp_parse_longname(lname, SFTP_LONGNAME_DATE);
78+ assert_string_equal(value, "Mar");
79+ free(value);
80+ value = sftp_parse_longname(lname, SFTP_LONGNAME_TIME);
81+ assert_string_equal(value, "25");
82+ free(value);
83+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
84+ assert_string_equal(value, "14:29");
85+ free(value);
86+}
87+
88+static void test_sftp_parse_longname_invalid(void **state)
89+{
90+ const char *lname = NULL;
91+ char *value = NULL;
92+
93+ /* state not used */
94+ (void)state;
95+
96+ /* Invalid inputs should not crash
97+ */
98+ lname = NULL;
99+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
100+ assert_null(value);
101+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
102+ assert_null(value);
103+
104+ lname = "";
105+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
106+ assert_string_equal(value, "");
107+ free(value);
108+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
109+ assert_null(value);
110+
111+ lname = "-rwxr-xr-x 1";
112+ value = sftp_parse_longname(lname, SFTP_LONGNAME_PERM);
113+ assert_string_equal(value, "-rwxr-xr-x");
114+ free(value);
115+ value = sftp_parse_longname(lname, SFTP_LONGNAME_NAME);
116+ assert_null(value);
117+}
118+
119+int torture_run_tests(void)
120+{
121+ int rc;
122+ const struct CMUnitTest tests[] = {
123+ cmocka_unit_test(test_sftp_parse_longname),
124+ cmocka_unit_test(test_sftp_parse_longname_invalid),
125+ };
126+
127+ rc = cmocka_run_group_tests(tests, NULL, NULL);
128+ return rc;
129+}
130--
1312.51.0
132
diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.3.bb b/meta-oe/recipes-support/libssh/libssh_0.11.3.bb
index ab47931fa3..1d4fd637d9 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.11.3.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.11.3.bb
@@ -11,6 +11,8 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable
11 file://run-ptest \ 11 file://run-ptest \
12 file://CVE-2026-3731_p1.patch \ 12 file://CVE-2026-3731_p1.patch \
13 file://CVE-2026-3731_p2.patch \ 13 file://CVE-2026-3731_p2.patch \
14 file://CVE-2026-0968_p1.patch \
15 file://CVE-2026-0968_p2.patch \
14 " 16 "
15 17
16SRC_URI:append:toolchain-clang = " file://0001-CompilerChecks.cmake-drop-Wunused-variable-flag.patch" 18SRC_URI:append:toolchain-clang = " file://0001-CompilerChecks.cmake-drop-Wunused-variable-flag.patch"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-22 01:37:41 +0000