mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 16:01:54 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libssh2: fix CVE-2026-66034

Browse Source 
Backport the fix for CVE-2026-66034.

The publickey subsystem does not sufficiently validate the length of a
server-controlled comment field. A malformed response can therefore
cause an out-of-bounds read.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Stefan Müller
2026-08-20 07:32:07 +00:00
committed by Julien Olivain
parent 6755a00cd2
commit 58581deeca
2 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
package/libssh2/0009-publickey-fix-potential-OOB-read.patch Normal file
View File

@@ -0,0 +1,36 @@
From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Sat, 4 Jul 2026 11:19:49 +0200
Subject: [PATCH] publickey: fix potential OOB read in
`libssh2_publickey_list_fetch()`
Reported-by: Vladimir Eli Tokarev
Fixes GHSA-w6g9-cpfp-22gc
Closes #2202
Forwarded: not-needed
CVE: CVE-2026-66034
Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66034.patch/
Upstream: https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
---
src/publickey.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/src/publickey.c
+++ b/src/publickey.c
@@ -988,6 +988,13 @@
}
if(comment_len) {
+ if(pkey->listFetch_s + comment_len >
+ pkey->listFetch_data + pkey->listFetch_data_len) {
+ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
+ "ListFetch data too short");
+ goto err_exit;
+ }
+
list[keys].num_attrs = 1;
list[keys].attrs =
LIBSSH2_ALLOC(session,

3
package/libssh2/libssh2.mk
View File

@@ -33,6 +33,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-66032
# 0008-openssl-fix-AES-GCM-bounds-checks.patch
LIBSSH2_IGNORE_CVES += CVE-2026-66033
# 0009-publickey-fix-potential-OOB-read.patch
LIBSSH2_IGNORE_CVES += CVE-2026-66034
ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
LIBSSH2_DEPENDENCIES += mbedtls
LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \