[ubuntu/jammy-security] libssh 0.9.6-2ubuntu0.22.04.8 (Accepted)

[Marc Deslauriers]

libssh (0.9.6-2ubuntu0.22.04.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service via zero advertised channel packet size
    - debian/patches/CVE-2026-59843-1.patch: channels: Fail when receiving max
      packet size 0 in src/channels.c, src/messages.c.
    - debian/patches/CVE-2026-59843-2.patch: tests: Verify zero max packet size
      in channel open is rejected in tests/unittests/torture_channel.c.
    - CVE-2026-59843
  * SECURITY UPDATE: Denial of service via unchecked ProxyCommand fork() failure
    - debian/patches/CVE-2026-59845.patch: socket: Properly check fork() return
      code in src/socket.c.
    - CVE-2026-59845
  * SECURITY UPDATE: Information disclosure via ProxyCommand %r username
    expansion
    - debian/patches/CVE-2026-59846-pre1.patch: misc: Add function to check
      username syntax in include/libssh/misc.h, src/misc.c,
      tests/unittests/torture_misc.c.
    - debian/patches/CVE-2026-59846.patch: Block shell metacharacters from
      usernames in include/libssh/priv.h, src/misc.c.
    - CVE-2026-59846
  * SECURITY UPDATE: Integrity downgrade via OpenSSL AES-GCM tag verification
    - debian/patches/CVE-2026-59847-1.patch: libcrypto: Fix tag verification of
      AES-GCM ciphers in src/libcrypto.c.
    - debian/patches/CVE-2026-59847-2.patch: libcrypto: Fix symmetric issue
      during encryption in src/libcrypto.c.
    - CVE-2026-59847
  * SECURITY UPDATE: Denial of service via SFTP responses with unknown request
    IDs
    - debian/patches/CVE-2026-59848-1.patch: sftp: handle responses with unknown
      request IDs in include/libssh/sftp.h, src/sftp.c,
      tests/client/torture_sftp_request_id.c, tests/client/CMakeLists.txt.
    - debian/patches/CVE-2026-59848-2.patch: sftp: Initialize sftp_request_queue
      ptr in sftp_free in src/sftp.c.
    - CVE-2026-59848
  * SECURITY UPDATE: Use-after-free via data callbacks on closed channels
    - debian/patches/CVE-2026-59850.patch: channels: Avoid processing DATA
      packets on closed channels in src/channels.c.
    - CVE-2026-59850

Date: 2026-08-24 17:59:15.705328+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/libssh/0.9.6-2ubuntu0.22.04.8
-------------- next part --------------
Sorry, changesfile not available.