From 93e7a673e83ee9b66f10f70cd3c7c0a53dcee6b0 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Tue, 21 Jul 2026 20:43:16 +0200 Subject: [PATCH] package/libssh: security bump version to 0.12.1 https://gitlab.com/libssh/libssh-mirror/-/tags/libssh-0.12.1 https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/ Fixes the following security problems: CVE-2026-15370: Stack buffer overflow in SFTP server longname construction CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key CVE-2026-59843: Denial of service via zero advertised channel packet size CVE-2026-59844: Denial of service via oversized SFTP read length CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs CVE-2026-59849: Denial of service via automatic certificate authentication loop CVE-2026-59850: Use-after-free via data callbacks on closed channels CVE-2026-59851: Authentication bypass via missing GSSAPI principal check Zero-initialize every ssh_string Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/libssh/libssh.hash | 4 ++-- package/libssh/libssh.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libssh/libssh.hash b/package/libssh/libssh.hash index 8c40dea2e5..a1f59fe810 100644 --- a/package/libssh/libssh.hash +++ b/package/libssh/libssh.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -# https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz.asc +# https://www.libssh.org/files/0.12/libssh-0.12.1.tar.xz.asc # with key 88A228D89B07C2C77D0C780903D5DF8CFDD3E8E7 -sha256 1a6af424d8327e5eedef4e5fe7f5b924226dd617ac9f3de80f217d82a36a7121 libssh-0.12.0.tar.xz +sha256 d3941af0a2d78d5d82ed7a36988e9133994312f035b9659a6e43f8db3968784c libssh-0.12.1.tar.xz sha256 1656186e951db1c010a8485481fa94587f7e53a26d24976bef97945ad0c4df5a COPYING diff --git a/package/libssh/libssh.mk b/package/libssh/libssh.mk index 017ff2c197..5fd34b47b0 100644 --- a/package/libssh/libssh.mk +++ b/package/libssh/libssh.mk @@ -5,7 +5,7 @@ ################################################################################ LIBSSH_VERSION_MAJOR = 0.12 -LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).0 +LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).1 LIBSSH_SOURCE = libssh-$(LIBSSH_VERSION).tar.xz LIBSSH_SITE = https://www.libssh.org/files/$(LIBSSH_VERSION_MAJOR) LIBSSH_LICENSE = LGPL-2.1