UbuntuUpdates.org

Package "libssh"

Name: libssh

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • tiny C SSH library (OpenSSL flavor)
  • tiny C SSH library - Development files (OpenSSL flavor)
  • tiny C SSH library - Documentation files
  • tiny C SSH library (gcrypt flavor)
Latest version: 0.9.6-2ubuntu0.22.04.8
Release: jammy (22.04)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libssh" in Jammy

Repository Area Version
base main 0.9.6-2build1
security main 0.9.6-2ubuntu0.22.04.8

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 0.9.6-2ubuntu0.22.04.8 2026-08-31 15:07:44 UTC

libssh (0.9.6-2ubuntu0.22.04.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service via zero advertised channel packet size
    - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max
      packet size 0 in src/channels.c, src/messages.c.
    - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size
      in channel open is rejected in tests/unittests/torture_channel.c.
    - CVE-2026-59843
  * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure
    - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return
      code in src/socket.c.
    - CVE-2026-59845
  * SECURITY UPDATE: Information disclosure via ProxyCommand %r username
    expansion
    - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check
      username syntax in include/libssh/misc.h, src/misc.c,
      tests/unittests/torture_misc.c.
    - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from
      usernames in include/libssh/priv.h, src/misc.c.
    - CVE-2026-59846
  * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification
    - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of
      AES-GCM ciphers in src/libcrypto.c.
    - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue
      during encryption in src/libcrypto.c.
    - CVE-2026-59847
  * SECURITY UPDATE: Denial of service via SFTP responses with unknown request
    IDs
    - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown
      request IDs in include/libssh/sftp.h, src/sftp.c,
      tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.
    - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue
      ptr in sftp_free in src/sftp.c.
    - CVE-2026-59848
  * SECURITY UPDATE: Use-after-free via data callbacks on closed channels
    - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA
      packets on closed channels in src/channels.c.
    - CVE-2026-59850

 -- Marc Deslauriers Mon, 24 Aug 2026 11:20:14 -0400
Source diff to previous version
CVE-2026-59843 A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel write
CVE-2026-59845 A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then b
CVE-2026-59846 A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment v
CVE-2026-59847 A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, al
CVE-2026-59848 A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing
CVE-2026-59850 A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data

Version: 0.9.6-2ubuntu0.22.04.7 2026-03-16 20:08:02 UTC

  libssh (0.9.6-2ubuntu0.22.04.7) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bound read
    - debian/patches/CVE-2026-3731.patch: correct bounds checks when querying
      for an SFTP extension name or data in src/sftp.c.
    - CVE-2026-3731

 -- Ian Constantin <email address hidden> Wed, 11 Mar 2026 12:19:27 +0200
Source diff to previous version
CVE-2026-3731 A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the

Version: 0.9.6-2ubuntu0.22.04.6 2026-02-19 00:07:46 UTC

  libssh (0.9.6-2ubuntu0.22.04.6) jammy-security; urgency=medium

  * SECURITY UPDATE: memory leak in key exchange
    - debian/patches/CVE-2025-8277-1.patch: adjust packet filter to work
      when DH-GEX is guessed wrongly in src/packet.c.
    - debian/patches/CVE-2025-8277-2.patch: fix memory leak of unused
      ephemeral key pair after client's wrong KEX guess in src/dh_crypto.c,
      src/dh_key.c, src/ecdh_crypto.c, src/ecdh_gcrypt.c,
      src/ecdh_mbedcrypto.c.
    - debian/patches/CVE-2025-8277-3.patch: free previously allocated
      pubkeys in src/ecdh_crypto.c, src/ecdh_gcrypt.c.
    - debian/patches/CVE-2025-8277-4.patch: avoid leaking ecdh keys in
      src/ecdh_mbedcrypto.c, src/wrapper.c.
    - CVE-2025-8277
  * SECURITY UPDATE: Improper sanitation of paths received from SCP servers
    - debian/patches/CVE-2026-0964.patch: reject invalid paths received
      through scp in src/scp.c.
    - CVE-2026-0964
  * SECURITY UPDATE: DoS via improper configuration file handling
    - debian/patches/CVE-2026-0965.patch: do not attempt to read
      non-regular and too large configuration files in
      include/libssh/misc.h, include/libssh/priv.h, src/bind_config.c,
      src/config.c, src/dh-gex.c, src/known_hosts.c, src/knownhosts.c,
      src/misc.c, tests/unittests/torture_config.c.
    - CVE-2026-0965
  * SECURITY UPDATE: Buffer underflow in ssh_get_hexa() on invalid input
    - debian/patches/CVE-2026-0966-1.patch: avoid heap buffer underflow in
      ssh_get_hexa in src/misc.c.
    - debian/patches/CVE-2026-0966-2.patch: test coverage for ssh_get_hexa
      in tests/unittests/torture_misc.c.
    - debian/patches/CVE-2026-0966-3.patch: update guided tour to use
      SHA256 fingerprints in doc/guided_tour.dox.
    - CVE-2026-0966
  * SECURITY UPDATE: DoS via inefficient regular expression processing
    - debian/patches/CVE-2026-0967.patch: avoid recursive matching (ReDoS)
      in src/match.c, tests/unittests/torture_config.c.
    - CVE-2026-0967
  * SECURITY UPDATE: DoS due to malformed SFTP message
    - debian/patches/CVE-2026-0968-1.patch: sanitize input handling in
      sftp_parse_longname() in src/sftp.c.
    - debian/patches/CVE-2026-0968-2.patch: reproducer for invalid longname
      data in tests/unittests/CMakeLists.txt,
      tests/unittests/torture_unit_sftp.c.
    - CVE-2026-0968

 -- Marc Deslauriers <email address hidden> Fri, 13 Feb 2026 10:22:49 -0500
Source diff to previous version
CVE-2025-8277 A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free
CVE-2026-0964 Improper sanitation of paths received from SCP servers
CVE-2026-0965 Denial of Service via improper configuration file handling
CVE-2026-0966 Buffer underflow in ssh_get_hexa() on invalid input
CVE-2026-0967 Denial of Service via inefficient regular expression processing
CVE-2026-0968 Denial of Service due to malformed SFTP message

Version: 0.9.6-2ubuntu0.22.04.5 2025-10-31 04:07:06 UTC

  libssh (0.9.6-2ubuntu0.22.04.5) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2025-8114.patch: sets rc to SSH_ERROR prior to goto
      error in ssh_make_sessionid() of src/kex.c.
    - CVE-2025-8114

 -- Ian Constantin <email address hidden> Wed, 29 Oct 2025 14:58:26 +0200
Source diff to previous version
CVE-2025-8114 A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an all

Version: 0.9.6-2ubuntu0.22.04.4 2025-07-07 19:07:10 UTC

  libssh (0.9.6-2ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Write beyond bounds in binary to base64 conversion
    functions
    - debian/patches/CVE-2025-4877.patch: prevent integer overflow and
      potential OOB.
    - CVE-2025-4877
  * SECURITY UPDATE: Use of uninitialized variable in
    privatekey_from_file()
    - debian/patches/CVE-2025-4878-1.patch: initialize pointers where
      possible.
    - debian/patches/CVE-2025-4878-2.patch: properly check return value to
      avoid NULL pointer dereference.
    - CVE-2025-4878
  * SECURITY UPDATE: OOB read in sftp_handle function
    - debian/patches/CVE-2025-5318.patch: fix possible buffer overrun.
    - CVE-2025-5318
  * SECURITY UPDATE: ssh_kdf() returns a success code on certain failures
    - debian/patches/CVE-2025-5372-pre1.patch: Reformat ssh_kdf().
    - debian/patches/CVE-2025-5372.patch: simplify error checking and
      handling of return codes in ssh_kdf().
    - CVE-2025-5372
  * SECURITY UPDATE: Missing packet filter may expose to variant of
    Terrapin attack
    - debian/patches/missing_packet_filter.patch: implement missing packet
      filter for DH GEX.
    - No CVE number

 -- Marc Deslauriers <email address hidden> Wed, 02 Jul 2025 14:48:47 -0400
CVE-2025-5318 A flaw was found in the libssh library. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that
CVE-2025-5372 A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation


About   -   Send Feedback to @ubuntu_updates