mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 16:24:17 -09:00
018c7b9108
Backport the fix for CVE-2026-66035.
The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 03757abfce)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
78 lines
2.5 KiB
Makefile
78 lines
2.5 KiB
Makefile
################################################################################
|
|
#
|
|
# libssh2
|
|
#
|
|
################################################################################
|
|
|
|
LIBSSH2_VERSION = 1.11.1
|
|
LIBSSH2_SOURCE= libssh2-$(LIBSSH2_VERSION).tar.xz
|
|
LIBSSH2_SITE = https://www.libssh2.org/download
|
|
LIBSSH2_LICENSE = BSD
|
|
LIBSSH2_LICENSE_FILES = COPYING
|
|
LIBSSH2_CPE_ID_VENDOR = libssh2
|
|
LIBSSH2_INSTALL_STAGING = YES
|
|
LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath
|
|
|
|
# 0001-username-len-bound-checking.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-7598
|
|
|
|
# 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-55199
|
|
|
|
# 0003-transport-c-Additional-boundary-checks-for-packet-length.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-55200
|
|
|
|
# 0004-sftp-symlink-fix-out-of-bounds-read.patch
|
|
# 0005-libssh2-priv-backport-LIBSSH2_UNCONST.patch
|
|
# 0006-sftp-symlink-fix-SSH_FXP_STATUS-response.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2025-15661
|
|
|
|
# 0007-sftp-prevent-dangling-pointer-after-free.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-66032
|
|
|
|
# 0008-openssl-fix-AES-GCM-bounds-checks.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-66033
|
|
|
|
# 0009-publickey-fix-potential-OOB-read.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-66034
|
|
|
|
# 0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch
|
|
LIBSSH2_IGNORE_CVES += CVE-2026-66035
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
|
|
LIBSSH2_DEPENDENCIES += mbedtls
|
|
LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \
|
|
--with-crypto=mbedtls
|
|
else ifeq ($(BR2_PACKAGE_LIBSSH2_LIBGCRYPT),y)
|
|
LIBSSH2_DEPENDENCIES += libgcrypt
|
|
LIBSSH2_CONF_OPTS += --with-libgcrypt-prefix=$(STAGING_DIR)/usr \
|
|
--with-crypto=libgcrypt
|
|
# configure.ac forgets to link to dependent libraries of gcrypt breaking static
|
|
# linking
|
|
LIBSSH2_CONF_ENV += LIBS="`$(STAGING_DIR)/usr/bin/libgcrypt-config --libs`"
|
|
else ifeq ($(BR2_PACKAGE_LIBSSH2_OPENSSL),y)
|
|
LIBSSH2_DEPENDENCIES += host-pkgconf openssl
|
|
LIBSSH2_CONF_OPTS += --with-libssl-prefix=$(STAGING_DIR)/usr \
|
|
--with-crypto=openssl
|
|
# configure.ac forgets to link to dependent libraries of openssl breaking static
|
|
# linking
|
|
LIBSSH2_CONF_ENV += LIBS=`$(PKG_CONFIG_HOST_BINARY) --libs openssl`
|
|
endif
|
|
|
|
# Add zlib support if enabled
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
LIBSSH2_DEPENDENCIES += zlib
|
|
LIBSSH2_CONF_OPTS += --with-libz \
|
|
--with-libz-prefix=$(STAGING_DIR)/usr
|
|
else
|
|
LIBSSH2_CONF_OPTS += --without-libz
|
|
endif
|
|
|
|
HOST_LIBSSH2_DEPENDENCIES += host-openssl
|
|
HOST_LIBSSH2_CONF_OPTS += --with-openssl \
|
|
--with-libssl-prefix=$(HOST_DIR) \
|
|
--without-libgcrypt
|
|
|
|
$(eval $(autotools-package))
|
|
$(eval $(host-autotools-package))
|