From patchwork Thu Nov 12 17:04:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10740 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jQRbJ43Wkz3wbB for ; Thu, 12 Nov 2026 17:05:16 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jQRbG1FjGz87Q for ; Thu, 12 Nov 2026 17:05:14 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jQRbF14B6z33HD for ; Thu, 12 Nov 2026 17:05:13 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jQRbB1lRkz33d3 for ; Thu, 12 Nov 2026 17:05:10 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jQRb8206kz45w; Thu, 12 Nov 2026 17:05:08 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1794503108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iRLc7OABMMHn41sXrXjJJgghieVb3i2OfMdYb2u6FuA=; b=Ne3zMQ8xb3bPVhmZ3tiQ8ega1Rfhf+U7u+DpIfayhn1+HS9tvf/vqixCsdKsR9qpuH+1m8 vs3Cx+briF56KzAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1794503108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iRLc7OABMMHn41sXrXjJJgghieVb3i2OfMdYb2u6FuA=; b=CLWHqTBMObOJx+ooThRpoxhV/gRJZ/86OGxpI0SDhT+YhZbaRhsYk9qfEA5sy0BXa6PQzv QkYdnjoDOeZHtRSu4tUOBLujNdxvQfAzW8b75inEqhbQh+lf5Z3566UfrxRhIhtEkNc+nV kB5fO0V3HSzhBlSSbHUBFEXs797/xI4Exef1R7U1ypseshZYnlOXZ0gkxEf8YPGE0n7BYP kcBKKkH8joi0rcluUjH3xTEAmyV/qP9GnhIAJX/Wsu+BSxEsAaAQTESiU53dJj7L6hnCoz gYREnmXTymk0paLW6cWYBuoHmhpJZkwLT0eNDN9iXAkMMfmkoxJKpSnwzO7y2A== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] libssh: Update to version 0.12.2 Date: Thu, 12 Nov 2026 18:04:56 +0100 Message-ID: <20261112170458.2062476-4-adolf.belka@ipfire.org> In-Reply-To: <20261112170458.2062476-1-adolf.belka@ipfire.org> References: <20261112170458.2062476-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 0.11.3 to 0.12.2 - Update of rootfile - 17 CVE fixes in total -1 in 0.12.2, 10 in 0.12.1 and 6 in 0.11.4 - Changelog 0.12.2 * Security: * CVE-2026-59843: Denial of service via zero advertised channel packet size (accidentally missed from previous release backports) * Bugfixes: * Fix fallback to default provider if FIPS provider does not have ML-KEM implementation * Do not override explicitly set options through a configuration file to match OpenSSH behavior. * Return SSH_KNOWN_HOSTS_UNKNOWN when GSSAPI key exchange is used without any hostkey * New API: * API to check the GSSAPI key exchange was used for hostkey handling * API to initiate GSSAPI keyex authentication (missing from last release) 0.12.1 * Security: * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction * CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key * CVE-2026-59844: Denial of service via oversized SFTP read length * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs * CVE-2026-59849: Denial of service via automatic certificate authentication loop * CVE-2026-59850: Use-after-free via data callbacks on closed channels * CVE-2026-59851: Authentication bypass via missing GSSAPI principal check * Zero-initialize every ssh_string * Compatibility: * Fix compatibility with C23 / gcc16 * Allow hybrid ML-KEM key exchange in FIPS mode * Bugfixes: * Fix multiple memory leaks, null checks, and error checks * Fix parameter size mismatch in mlkem768x25519-sha256 * Fix client SFTP messages being ignored if sent at high rate * Validate peer public key in DH key exchange * Fix ambiguous error reporting of sftp_init * Fix hidden integer underflow in socket packet callback * Avoid remote window overflow * Fix socket data callback return value on rekey failure * Avoid off-by-one overflow during kbdint authentication * Avoid logging uninitialized sequence numbers * Avoid double conversion of SFTP version number * Send correct SFTP server version number * Avoid handling repeated SFTP INIT messages * Harmonize return values from SFTP server callbacks 0.12.0 * Deprecations and removals: * Bumped minimal RSA key size to 1024 bits * New functionality: * Add support for hybrid key exchange mechanisms using Quantum Resistant cryptography for all backends. These are now preferred: * sntrup761x25519-sha512, sntrup761x25519-sha512@openssh.com * mlkem768nistp256-sha256 * mlkem768x25519-sha256 * mlkem1024nistp384-sha384 (only OpenSSL 3.5+ and libgcrypt) * New cmake option WITH_HERMETIC_USR * Added support for Ed25519 keys through PKCS#11 * Support for host-bound public key authentication (publickey-hostbound-v00@openssh.com) * Use curve25519 implementation from mbedTLS and libgcrypt * New functions for signing arbitrary data (commits) with SSH keys * sshsig_sign() * sshsig_verify() * Support for FIDO/U2F keys (internal implementation using libfido2) * Compatible with OpenSSH: should work out of the box * Extensible with callbacks * Add support for GSSAPI Key Exchange (RFC 4462, RFC 8732) * Add support for new configuration options (client and server): * RequiredRsaSize * AddressFamily (client) * GSSAPIKeyExchange * GSSAPIKexAlgorithms * New option to get list of configured identities (SSH_OPTIONS_NEXT_IDENTITY) * More OpenSSH compatible percent expansion characters * Add new server auth_kbdint_function() callback * New PKI Context structure for key operations * Stability and compatibility improvements of ProxyJump * SFTP * Prevent failures when SFTP status message does not contain error message * Fix possible timeouts while waiting for SFTP messages * Support for users-groups-by-id@openssh.com extension in client * Support for SSH_FXF_TRUNC in server 0.11.4 * Security: * CVE-2025-14821: libssh loads configuration files from the C:\etc directory on Windows * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() * CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input * CVE-2026-0967: Specially crafted patterns could cause DoS * CVE-2026-0968: OOB Read in sftp_parse_longname() * libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP extensions * Stability and compatibility improvements of ProxyJump Signed-off-by: Adolf Belka --- config/rootfiles/common/libssh | 2 +- lfs/libssh | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/libssh b/config/rootfiles/common/libssh index d0b55519f..f1c62b25a 100644 --- a/config/rootfiles/common/libssh +++ b/config/rootfiles/common/libssh @@ -14,5 +14,5 @@ #usr/lib/cmake/libssh/libssh-config.cmake #usr/lib/libssh.so usr/lib/libssh.so.4 -usr/lib/libssh.so.4.10.3 +usr/lib/libssh.so.4.12.0 #usr/lib/pkgconfig/libssh.pc diff --git a/lfs/libssh b/lfs/libssh index 26d41dd38..90e0618c6 100644 --- a/lfs/libssh +++ b/lfs/libssh @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 0.11.3 +VER = 0.12.2 THISAPP = libssh-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 859e4af9bf6305e54175e456d153a85e678a6fc49ac184dbe09d94ab01dde42f0321f5a2ac35cf4ca9df188daab6c4bf3171dcd8a3776419a3a1a20474ccf89a +$(DL_FILE)_BLAKE2 = 1cb3b2b05e399181dd215502bb1802fb8d428249f809ba166a90903f67825dac1d4639d57177b3f820529759f61a58e58a51d3502e24ef68c86e4804f4c8b738 install : $(TARGET)