Source: libssh Version: 0.12.0-3 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for libssh. Making a RC bug due to the amount of CVEs mainly and two CVEs only relevant for 0.12.0. We still need to assess the rest for trixie. CVE-2026-15370[0]: | A flaw was found in libssh. During SFTP server directory listing, | the longname field is constructed with unsafe concatenation into a | fixed-size stack buffer. When a client causes the server to list | attacker-controlled filenames, sufficiently long names can overflow | that stack buffer and may lead to crashes or possible code execution | on the server. CVE-2026-59842[1]: | A flaw was found in libssh. During server-side GSSAPI key exchange, | a client-supplied Curve25519 public key shorter than the expected | length is copied without proper length validation, leading to an | out-of-bounds heap read. This could allow a remote unauthenticated | attacker to disclose small amounts of server memory. CVE-2026-59843[2]: | A flaw was found in libssh. A remote authenticated peer can | advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, | causing later channel writes to loop indefinitely and consume CPU, | leading to denial of service. Can you help on this one to identify the needed upstream change? There is one from master branch referenced in the advisory but that does not look to be backported to libssh-0.12.1? CVE-2026-59844[3]: | A flaw was found in libssh. A remote authenticated client can issue | SSH_FXP_READ requests with an arbitrarily large length, causing a | libssh SFTP server to allocate excessive memory and potentially | exhaust it through repeated requests. CVE-2026-59845[4]: | A flaw was found in libssh. When ProxyCommand is used, an unchecked | fork() failure can be stored as process ID -1; during cleanup, | signals may then be sent across the caller's accessible process | tree, leading to local denial of service. CVE-2026-59846[5]: | Information disclosure via ProxyCommand %r username expansion CVE-2026-59847[6]: | Integrity downgrade via OpenSSL AES-GCM tag verification CVE-2026-59848[7]: | Denial of service via SFTP responses with unknown request IDs CVE-2026-59849[8]: | Denial of service via automatic certificate authentication loop CVE-2026-59850[9]: | Use-after-free via data callbacks on closed channels CVE-2026-59851[10]: | Authentication bypass via missing GSSAPI principal check If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-15370 https://www.cve.org/CVERecord?id=CVE-2026-15370 [1] https://security-tracker.debian.org/tracker/CVE-2026-59842 https://www.cve.org/CVERecord?id=CVE-2026-59842 [2] https://security-tracker.debian.org/tracker/CVE-2026-59843 https://www.cve.org/CVERecord?id=CVE-2026-59843 [3] https://security-tracker.debian.org/tracker/CVE-2026-59844 https://www.cve.org/CVERecord?id=CVE-2026-59844 [4] https://security-tracker.debian.org/tracker/CVE-2026-59845 https://www.cve.org/CVERecord?id=CVE-2026-59845 [5] https://security-tracker.debian.org/tracker/CVE-2026-59846 https://www.cve.org/CVERecord?id=CVE-2026-59846 [6] https://security-tracker.debian.org/tracker/CVE-2026-59847 https://www.cve.org/CVERecord?id=CVE-2026-59847 [7] https://security-tracker.debian.org/tracker/CVE-2026-59848 https://www.cve.org/CVERecord?id=CVE-2026-59848 [8] https://security-tracker.debian.org/tracker/CVE-2026-59849 https://www.cve.org/CVERecord?id=CVE-2026-59849 [9] https://security-tracker.debian.org/tracker/CVE-2026-59850 https://www.cve.org/CVERecord?id=CVE-2026-59850 [10] https://security-tracker.debian.org/tracker/CVE-2026-59851 https://www.cve.org/CVERecord?id=CVE-2026-59851 Regards, Salvatore
