From 9d8ef26a9693e2c70ae34abe1a753873d42ec588 Mon Sep 17 00:00:00 2001 From: Vijay Anusuri Date: Fri, 27 Mar 2026 15:29:04 +0530 Subject: [PATCH] libssh: Fix CVE-2026-0964 Pick commit according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-0964 [2] https://www.libssh.org/security/advisories/CVE-2026-0964.txt Signed-off-by: Vijay Anusuri Signed-off-by: Gyorgy Sarvari --- .../libssh/libssh/CVE-2026-0964.patch | 46 +++++++++++++++++++ .../recipes-support/libssh/libssh_0.8.9.bb | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch new file mode 100644 index 0000000000..7ad76c6e5e --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-0964.patch @@ -0,0 +1,46 @@ +From a5e4b12090b0c939d85af4f29280e40c5b6600aa Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Mon, 22 Dec 2025 19:16:44 +0100 +Subject: [PATCH] CVE-2026-0964 scp: Reject invalid paths received through scp + +Signed-off-by: Jakub Jelen +Reviewed-by: Andreas Schneider +(cherry picked from commit daa80818f89347b4d80b0c5b80659f9a9e55e8cc) + +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=a5e4b12090b0c939d85af4f29280e40c5b6600aa] +CVE: CVE-2026-0964 +Signed-off-by: Vijay Anusuri +--- + src/scp.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/src/scp.c b/src/scp.c +index 652551e3..4590cf79 100644 +--- a/src/scp.c ++++ b/src/scp.c +@@ -738,6 +738,22 @@ int ssh_scp_pull_request(ssh_scp scp) + size = strtoull(tmp, NULL, 10); + p++; + name = strdup(p); ++ /* Catch invalid name: ++ * - empty ones ++ * - containing any forward slash -- directory traversal handled ++ * differently ++ * - special names "." and ".." referring to the current and parent ++ * directories -- they are not expected either ++ */ ++ if (name == NULL || name[0] == '\0' || strchr(name, '/') || ++ strcmp(name, ".") == 0 || strcmp(name, "..") == 0) { ++ ssh_set_error(scp->session, ++ SSH_FATAL, ++ "Received invalid filename: %s", ++ name == NULL ? "" : name); ++ SAFE_FREE(name); ++ goto error; ++ } + SAFE_FREE(scp->request_name); + scp->request_name = name; + if (buffer[0] == 'C') { +-- +2.25.1 + diff --git a/meta-oe/recipes-support/libssh/libssh_0.8.9.bb b/meta-oe/recipes-support/libssh/libssh_0.8.9.bb index 8cc0883b2b..387720f7dd 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.8.9.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.8.9.bb @@ -31,6 +31,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://CVE-2026-3731.patch \ file://CVE-2026-0966-1.patch \ file://CVE-2026-0966-2.patch \ + file://CVE-2026-0964.patch \ " SRCREV = "04685a74df9ce1db1bc116a83a0da78b4f4fa1f8"