Backport patch to fix CVE-2026-58050.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-58050
Upstream fix:
https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12
Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
---
.../libssh2/libssh2/CVE-2026-58050.patch | 45 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 3 +-
2 files changed, 47 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-58050.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-58050.patch
b/meta/recipes-support/libssh2/libssh2/CVE-2026-58050.patch
new file mode 100644
index 0000000000..0163b379f3
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-58050.patch
@@ -0,0 +1,45 @@
+From 05b2fb4ec89d75235dbd97c5965dc0e46b405a7c Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <[email protected]>
+Date: Sun, 28 Jun 2026 02:12:52 +0200
+Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
+ `libssh2_publickey_list_fetch()`
+
+Cap list size at 1024 elements.
+
+Reported-and-initial-patch-by: Mateusz Gierblinski
+Reported-and-initial-patch-by: Behzod Abdullayev
+Reported-by: Sharique Raza
+
+Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
+
+Closes #2128
+
+src/publickey.c: replaced ssh2_err() with _libssh2_error() to match
+the stable branch's error-reporting convention.
+
+Assisted-by: kiro:claude-sonnet-5
+
+CVE: CVE-2026-58050
+Upstream-Status: Backport
[https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12]
+
+Signed-off-by: Adarsh Jagadish Kamini <[email protected]>
+---
+ src/publickey.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/publickey.c b/src/publickey.c
+index 9c9fa618..196d2f9f 100644
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -1114,6 +1114,11 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey,
unsigned long *num_keys,
+ }
+
+ if(list[keys].num_attrs) {
++ if(list[keys].num_attrs > 1024) {
++ _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
++ "Too many publickey attributes");
++ goto err_exit;
++ }
+ list[keys].attrs =
+ LIBSSH2_ALLOC(session,
+ list[keys].num_attrs *
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index f9c15ea977..0eb263b017 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -20,7 +20,8 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2026-66033.patch \
file://CVE-2026-66034.patch \
file://CVE-2026-66035.patch \
- "
+ file://CVE-2026-58050.patch \
+ "
SRC_URI[sha256sum] =
"d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#243284):
https://lists.openembedded.org/g/openembedded-core/message/243284
Mute This Topic: https://lists.openembedded.org/mt/120716447/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
