Stefan Müller 58581deeca package/libssh2: fix CVE-2026-66034 ...

Backport the fix for CVE-2026-66034.

The publickey subsystem does not sufficiently validate the length of a
server-controlled comment field. A malformed response can therefore
cause an out-of-bounds read.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>

2026-08-22 23:54:17 +02:00

1.2 KiB

Raw Permalink Blame History

View Raw