UbuntuUpdates.org

Package "libssh"

Name: libssh

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • tiny C SSH library (OpenSSL flavor)
  • tiny C SSH library - Development files (OpenSSL flavor)
  • tiny C SSH library - Documentation files
Latest version: 0.11.3-1ubuntu2.1
Release: resolute (26.04)
Level: security
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libssh" in Resolute

Repository Area Version
base main 0.11.3-1ubuntu1
updates main 0.11.3-1ubuntu2.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 0.11.3-1ubuntu2.1 2026-08-31 13:07:53 UTC

libssh (0.11.3-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Stack buffer overflow in SFTP server longname construction
    - debian/patches/CVE-2026-15370-1.patch: sftpserver: Avoid stack buffer
      overrun while processing long filenames in src/sftpserver.c.
    - debian/patches/CVE-2026-15370-2.patch: tests: verify the SFTP longname is
      in expected format in tests/server/torture_sftpserver.c.
    - CVE-2026-15370
  * SECURITY UPDATE: Denial of service via zero advertised channel packet size
    - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max
      packet size 0 in src/channels.c, src/messages.c.
    - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size
      in channel open is rejected in tests/unittests/torture_channel.c.
    - CVE-2026-59843
  * SECURITY UPDATE: Denial of service via oversized SFTP read length
    - debian/patches/CVE-2026-59844.patch: sftpserver: cap accepted values of
      len in SSH_FXP_READ in src/sftpserver.c.
    - CVE-2026-59844
  * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure
    - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return
      code in src/socket.c.
    - CVE-2026-59845
  * SECURITY UPDATE: Information disclosure via ProxyCommand %r username
    expansion
    - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from
      usernames in include/libssh/priv.h, src/misc.c.
    - CVE-2026-59846
  * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification
    - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of
      AES-GCM ciphers in src/libcrypto.c.
    - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue
      during encryption in src/libcrypto.c.
    - CVE-2026-59847
  * SECURITY UPDATE: Denial of service via SFTP responses with unknown request
    IDs
    - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown
      request IDs in include/libssh/sftp.h, include/libssh/sftp_priv.h,
      src/sftp.c, src/sftp_aio.c, src/sftp_common.c,
      tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.
    - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue
      ptr in sftp_free in src/sftp.c.
    - CVE-2026-59848
  * SECURITY UPDATE: Denial of service via automatic certificate authentication
    loop
    - debian/patches/CVE-2026-59849-1.patch: auth: Move certificate iterator on
      failure to prevent infinite loop in src/auth.c.
    - debian/patches/CVE-2026-59849-2.patch: auth: Fix state machine to aovid
      infinite loop in src/auth.c.
    - debian/patches/CVE-2026-59849-3.patch: tests: Reproducer for infinite
      loops with non-default configurations in tests/client/torture_auth_cert.c.
    - CVE-2026-59849
  * SECURITY UPDATE: Use-after-free via data callbacks on closed channels
    - debian/patches/CVE-2026-59850-1.patch: channels: Avoid processing DATA
      packets on closed channels in src/channels.c.
    - debian/patches/CVE-2026-59850-2.patch: tests: Verify sending data after
      close does not trigger callbacks in tests/server/torture_sftpserver.c.
    - CVE-2026-59850

 -- Marc Deslauriers Mon, 24 Aug 2026 09:47:19 -0400
Source diff to previous version
CVE-2026-15370 A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack
CVE-2026-59843 A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel write
CVE-2026-59844 A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP ser
CVE-2026-59845 A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then b
CVE-2026-59846 A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment v
CVE-2026-59847 A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, al
CVE-2026-59848 A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing
CVE-2026-59849 A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when
CVE-2026-59850 A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data

Version: 0.11.3-1ubuntu2 2026-08-19 10:07:48 UTC
No changelog available yet.


About   -   Send Feedback to @ubuntu_updates