From 9fb2e5ddd7ee631e8e6bb87c054eac9e2c8b2002 Mon Sep 17 00:00:00 2001 From: Wang Mingyu Date: Tue, 12 Aug 2025 17:03:16 +0530 Subject: libssh: upgrade 0.11.1 -> 0.11.2 * Security: * CVE-2025-4877 - Write beyond bounds in binary to base64 conversion * CVE-2025-4878 - Use of uninitialized variable in privatekey_from_file() * CVE-2025-5318 - Likely read beyond bounds in sftp server handle management * CVE-2025-5351 - Double free in functions exporting keys * CVE-2025-5372 - ssh_kdf() returns a success code on certain failures * CVE-2025-5449 - Likely read beyond bounds in sftp server message decoding * CVE-2025-5987 - Invalid return code for chacha20 poly1305 with OpenSSL * Compatibility * Fixed compatibility with CPM.cmake * Compatibility with OpenSSH 10.0 * Tests compatibility with new Dropbear releases * Removed p11-kit remoting from the pkcs11 testsuite * Bugfixes * Implement missing packet filter for DH GEX * Properly process the SSH2_MSG_DEBUG message * Allow escaping quotes in quoted arguments to ssh configuration * Do not fail with unknown match keywords in ssh configuration * Process packets before selecting signature algorithm during authentication * Do not fail hard when the SFTP status message is not sent by noncompliant servers Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj Signed-off-by: Divya Chellam Signed-off-by: Gyorgy Sarvari --- meta-oe/recipes-support/libssh/libssh_0.11.1.bb | 50 ------------------------- meta-oe/recipes-support/libssh/libssh_0.11.2.bb | 50 +++++++++++++++++++++++++ 2 files changed, 50 insertions(+), 50 deletions(-) delete mode 100644 meta-oe/recipes-support/libssh/libssh_0.11.1.bb create mode 100644 meta-oe/recipes-support/libssh/libssh_0.11.2.bb (limited to 'meta-oe') diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.1.bb b/meta-oe/recipes-support/libssh/libssh_0.11.1.bb deleted file mode 100644 index 5f39c2d79c..0000000000 --- a/meta-oe/recipes-support/libssh/libssh_0.11.1.bb +++ /dev/null @@ -1,50 +0,0 @@ -SUMMARY = "Multiplatform C library implementing the SSHv2 and SSHv1 protocol" -HOMEPAGE = "http://www.libssh.org" -SECTION = "libs" -LICENSE = "LGPL-2.1-only" -LIC_FILES_CHKSUM = "file://COPYING;md5=dabb4958b830e5df11d2b0ed8ea255a0" - -DEPENDS = "zlib openssl" - -SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable-0.11 \ - file://0001-tests-CMakeLists.txt-do-not-search-ssh-sshd-commands.patch \ - file://run-ptest \ - " - -SRC_URI:append:toolchain-clang = " file://0001-CompilerChecks.cmake-drop-Wunused-variable-flag.patch" - -SRCREV = "854795c654eda518ed6de6c1ebb4e2107fcb2e73" - -S = "${WORKDIR}/git" - -inherit cmake ptest - -PACKAGECONFIG ??= "gcrypt ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}" -PACKAGECONFIG[gssapi] = "-DWITH_GSSAPI=1, -DWITH_GSSAPI=0, krb5, " -PACKAGECONFIG[gcrypt] = "-DWITH_GCRYPT=1, -DWITH_GCRYPT=0, libgcrypt, " -PACKAGECONFIG[tests] = "-DUNIT_TESTING=1, -DUNIT_TESTING=0, cmocka" - -ARM_INSTRUCTION_SET:armv5 = "arm" - -EXTRA_OECMAKE = " \ - -DWITH_PCAP=1 \ - -DWITH_SFTP=1 \ - -DWITH_ZLIB=1 \ - -DWITH_EXAMPLES=0 \ - " - -do_compile:prepend () { - if [ ${PTEST_ENABLED} = "1" ]; then - sed -i -e 's|${B}|${PTEST_PATH}|g' ${B}/config.h - sed -i -e 's|${S}|${PTEST_PATH}|g' ${B}/config.h - fi -} - -do_install_ptest () { - install -d ${D}${PTEST_PATH}/tests - cp -f ${B}/tests/unittests/torture_* ${D}${PTEST_PATH}/tests/ - install -d ${D}${PTEST_PATH}/tests/unittests - cp -f ${S}/tests/unittests/hello*.sh ${D}${PTEST_PATH}/tests/unittests/ -} - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.2.bb b/meta-oe/recipes-support/libssh/libssh_0.11.2.bb new file mode 100644 index 0000000000..5baaa49949 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh_0.11.2.bb @@ -0,0 +1,50 @@ +SUMMARY = "Multiplatform C library implementing the SSHv2 and SSHv1 protocol" +HOMEPAGE = "http://www.libssh.org" +SECTION = "libs" +LICENSE = "LGPL-2.1-only" +LIC_FILES_CHKSUM = "file://COPYING;md5=dabb4958b830e5df11d2b0ed8ea255a0" + +DEPENDS = "zlib openssl" + +SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable-0.11;tag=${BPN}-${PV} \ + file://0001-tests-CMakeLists.txt-do-not-search-ssh-sshd-commands.patch \ + file://run-ptest \ + " + +SRC_URI:append:toolchain-clang = " file://0001-CompilerChecks.cmake-drop-Wunused-variable-flag.patch" + +SRCREV = "dff6c0821ed54f6fbf5b755af43f54cbb723b1b1" + +S = "${WORKDIR}/git" + +inherit cmake ptest + +PACKAGECONFIG ??= "gcrypt ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}" +PACKAGECONFIG[gssapi] = "-DWITH_GSSAPI=1, -DWITH_GSSAPI=0, krb5, " +PACKAGECONFIG[gcrypt] = "-DWITH_GCRYPT=1, -DWITH_GCRYPT=0, libgcrypt, " +PACKAGECONFIG[tests] = "-DUNIT_TESTING=1, -DUNIT_TESTING=0, cmocka" + +ARM_INSTRUCTION_SET:armv5 = "arm" + +EXTRA_OECMAKE = " \ + -DWITH_PCAP=1 \ + -DWITH_SFTP=1 \ + -DWITH_ZLIB=1 \ + -DWITH_EXAMPLES=0 \ + " + +do_compile:prepend () { + if [ ${PTEST_ENABLED} = "1" ]; then + sed -i -e 's|${B}|${PTEST_PATH}|g' ${B}/config.h + sed -i -e 's|${S}|${PTEST_PATH}|g' ${B}/config.h + fi +} + +do_install_ptest () { + install -d ${D}${PTEST_PATH}/tests + cp -f ${B}/tests/unittests/torture_* ${D}${PTEST_PATH}/tests/ + install -d ${D}${PTEST_PATH}/tests/unittests + cp -f ${S}/tests/unittests/hello*.sh ${D}${PTEST_PATH}/tests/unittests/ +} + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3-54-g00ecf