libssh: Update to version 0.12.2

- Update from version 0.11.3 to 0.12.2
- Update of rootfile
- 17 CVE fixes in total -1 in 0.12.2, 10 in 0.12.1 and 6 in 0.11.4
- Changelog
0.12.2
 * Security:
   * CVE-2026-59843: Denial of service via zero advertised channel packet size
     (accidentally missed from previous release backports)
 * Bugfixes:
   * Fix fallback to default provider if FIPS provider does not have ML-KEM
     implementation
   * Do not override explicitly set options through a configuration file to
     match OpenSSH behavior.
   * Return SSH_KNOWN_HOSTS_UNKNOWN when GSSAPI key exchange is used without any
     hostkey
 * New API:
   * API to check the GSSAPI key exchange was used for hostkey handling
   * API to initiate GSSAPI keyex authentication (missing from last release)
0.12.1
 * Security:
   * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
   * CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
   * CVE-2026-59844: Denial of service via oversized SFTP read length
   * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
   * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
   * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
   * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
   * CVE-2026-59849: Denial of service via automatic certificate authentication loop
   * CVE-2026-59850: Use-after-free via data callbacks on closed channels
   * CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
   * Zero-initialize every ssh_string
 * Compatibility:
   * Fix compatibility with C23 / gcc16
   * Allow hybrid ML-KEM key exchange in FIPS mode
 * Bugfixes:
   * Fix multiple memory leaks, null checks, and error checks
   * Fix parameter size mismatch in mlkem768x25519-sha256
   * Fix client SFTP messages being ignored if sent at high rate
   * Validate peer public key in DH key exchange
   * Fix ambiguous error reporting of sftp_init
   * Fix hidden integer underflow in socket packet callback
   * Avoid remote window overflow
   * Fix socket data callback return value on rekey failure
   * Avoid off-by-one overflow during kbdint authentication
   * Avoid logging uninitialized sequence numbers
   * Avoid double conversion of SFTP version number
   * Send correct SFTP server version number
   * Avoid handling repeated SFTP INIT messages
   * Harmonize return values from SFTP server callbacks
0.12.0
 * Deprecations and removals:
   * Bumped minimal RSA key size to 1024 bits
 * New functionality:
   * Add support for hybrid key exchange mechanisms using Quantum Resistant
     cryptography for all backends. These are now preferred:
     * sntrup761x25519-sha512, sntrup761x25519-sha512@openssh.com
     * mlkem768nistp256-sha256
     * mlkem768x25519-sha256
     * mlkem1024nistp384-sha384 (only OpenSSL 3.5+ and libgcrypt)
   * New cmake option WITH_HERMETIC_USR
   * Added support for Ed25519 keys through PKCS#11
   * Support for host-bound public key authentication
     (publickey-hostbound-v00@openssh.com)
   * Use curve25519 implementation from mbedTLS and libgcrypt
   * New functions for signing arbitrary data (commits) with SSH keys
     * sshsig_sign()
     * sshsig_verify()
   * Support for FIDO/U2F keys (internal implementation using libfido2)
     * Compatible with OpenSSH: should work out of the box
     * Extensible with callbacks
   * Add support for GSSAPI Key Exchange (RFC 4462, RFC 8732)
   * Add support for new configuration options (client and server):
     * RequiredRsaSize
     * AddressFamily (client)
     * GSSAPIKeyExchange
     * GSSAPIKexAlgorithms
   * New option to get list of configured identities (SSH_OPTIONS_NEXT_IDENTITY)
   * More OpenSSH compatible percent expansion characters
   * Add new server auth_kbdint_function() callback
   * New PKI Context structure for key operations
   * Stability and compatibility improvements of ProxyJump
 * SFTP
   * Prevent failures when SFTP status message does not contain error message
   * Fix possible timeouts while waiting for SFTP messages
   * Support for users-groups-by-id@openssh.com extension in client
   * Support for SSH_FXF_TRUNC in server
0.11.4
 * Security:
   * CVE-2025-14821: libssh loads configuration files from the C:\etc directory
     on Windows
   * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
   * CVE-2026-0965: Possible Denial of Service when parsing unexpected
     configuration files
   * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
   * CVE-2026-0967: Specially crafted patterns could cause DoS
   * CVE-2026-0968: OOB Read in sftp_parse_longname()
   * libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP
     extensions
 * Stability and compatibility improvements of ProxyJump

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/libssh | 2 +-
 lfs/libssh                     | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)