From f54e7d710c6dd7d46702304ec8d7ea9e7a8252ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= Date: Sat, 28 Feb 2026 10:03:27 +0100 Subject: [PATCH] package/libssh: Security bump to 0.11.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change summary: https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.11.4 Fixes: CVE-2025-14821: libssh loads configuration files from the C:\etc directory on Windows CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input CVE-2026-0967: Specially crafted patterns could cause DoS CVE-2026-0968: OOB Read in sftp_parse_longname() libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP extensions Signed-off-by: Mattias Walström [Julien: - add link to upstream change summary - fix signature link in hash file ] Signed-off-by: Julien Olivain --- package/libssh/libssh.hash | 4 ++-- package/libssh/libssh.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libssh/libssh.hash b/package/libssh/libssh.hash index 1c15d77a45..5a103eb593 100644 --- a/package/libssh/libssh.hash +++ b/package/libssh/libssh.hash @@ -1,5 +1,5 @@ # Locally calculated after checking pgp signature -# https://www.libssh.org/files/0.11/libssh-0.11.3.tar.xz.asc +# https://www.libssh.org/files/0.11/libssh-0.11.4.tar.xz.asc # with key 88A228D89B07C2C77D0C780903D5DF8CFDD3E8E7 -sha256 7d8a1361bb094ec3f511964e78a5a4dba689b5986e112afabe4f4d0d6c6125c3 libssh-0.11.3.tar.xz +sha256 002ac320e3d66c9e100ec6576e3e84aa0c48949efde3bf5b40a2802992297701 libssh-0.11.4.tar.xz sha256 1656186e951db1c010a8485481fa94587f7e53a26d24976bef97945ad0c4df5a COPYING diff --git a/package/libssh/libssh.mk b/package/libssh/libssh.mk index 3c7e77a206..56de66d6ea 100644 --- a/package/libssh/libssh.mk +++ b/package/libssh/libssh.mk @@ -5,7 +5,7 @@ ################################################################################ LIBSSH_VERSION_MAJOR = 0.11 -LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).3 +LIBSSH_VERSION = $(LIBSSH_VERSION_MAJOR).4 LIBSSH_SOURCE = libssh-$(LIBSSH_VERSION).tar.xz LIBSSH_SITE = https://www.libssh.org/files/$(LIBSSH_VERSION_MAJOR) LIBSSH_LICENSE = LGPL-2.1