-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 26 Jul 2026 16:26:27 +0200
Source: libssh
Architecture: source
Version: 0.12.1-1
Distribution: unstable
Urgency: medium
Maintainer: Laurent Bigonville <bigon@debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Changes:
libssh (0.12.1-1) unstable; urgency=medium
.
* New upstream security release:
- CVE-2026-15370: Stack buffer overflow in SFTP server longname
construction
- CVE-2026-59842: Information disclosure via short GSSAPI Curve25519
public key
- CVE-2026-59844: Denial of service via oversized SFTP read length
- CVE-2026-59845: Denial of service via unchecked ProxyCommand fork()
failure
- CVE-2026-59846: Information disclosure via ProxyCommand %r username
expansion
- CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
- CVE-2026-59848: Denial of service via SFTP responses with unknown
request IDs
- CVE-2026-59849: Denial of service via automatic certificate
authentication loop
- CVE-2026-59850: Use-after-free via data callbacks on closed channels
- CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
- Zero-initialize every ssh_string
* channels: Fail when receiving max packet size 0.
Backported from master commit 44b186fa17af. Add a corresponding unit
test (forwarded upstream). CVE-2026-59843
* Bump Standards-Version to 4.7.4. No changes necessary.
Checksums-Sha1:
7d193e363cdaa1b9d0b095ee26e6d9d89a69e236 2627 libssh_0.12.1-1.dsc
816c8a9f7fe011db0dfc29ce97448e10d7a8ccb2 756384 libssh_0.12.1.orig.tar.xz
b22fa9e58af48aec96f18cba079a9a352f118471 833 libssh_0.12.1.orig.tar.xz.asc
59a84c2fe82136766222f932c8c943f6a6d0aebf 34828 libssh_0.12.1-1.debian.tar.xz
8eb0e3817682c7f79a0eceaceb85360074387418 8051 libssh_0.12.1-1_source.buildinfo
Checksums-Sha256:
d1387bb568fda0c767420150bd895ea04737cf55eefd35802e907729178b4690 2627 libssh_0.12.1-1.dsc
d3941af0a2d78d5d82ed7a36988e9133994312f035b9659a6e43f8db3968784c 756384 libssh_0.12.1.orig.tar.xz
6f312d22b211b4db6dfc4bc6059f12b3053b7cb6c639a71313708cf0b80ab47b 833 libssh_0.12.1.orig.tar.xz.asc
07504755f85c97cf8f7201b51697698a4b784315ac06ba7273ca04a42e7d35b6 34828 libssh_0.12.1-1.debian.tar.xz
c67ff73a265bebe7787ffc8bcb6b9763ef7ba9dec18ea8169f115686c37815a5 8051 libssh_0.12.1-1_source.buildinfo
Files:
4149c8479ec6516b7824a7ea4e1ef380 2627 libs optional libssh_0.12.1-1.dsc
b1332259cba0cc81350e3836de6ddca9 756384 libs optional libssh_0.12.1.orig.tar.xz
67cb1cf0c0026a17d594d4063f4ad48f 833 libs optional libssh_0.12.1.orig.tar.xz.asc
bf41f72580e79aa50fcc3dc7950bb88f 34828 libs optional libssh_0.12.1-1.debian.tar.xz
f41458c8bec290d8ffce516f068adef4 8051 libs optional libssh_0.12.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmpmGfUACgkQ7nvd5Lhr
VxPQmBAAn1HOmk1i7JkenYa+mPCmsmzCdKMnl7bGUN7sFkWPX8l2+MsZxwG6HtpC
Jws78UPf62QqbaPxvlZqv/ZeXPUF0J8zvYFSMPaUzwl3NGZGxboHNLOteHqhYjz/
XOvPUOsmgBSWH0e+77kyGRyOtfUzvdAheVO3YoKgll41XWUKbNdMmHbUQNvqu7Ch
OI7dGVJ7m5xbP9YBs7p3E1k7kSIIsYNE/T2VKqhNvElpwh/PifytZ0FvzzB7cXGH
6L6A6vamMjhrKJaNI4ePHfZvrOM0HJhnGmBH7UfplyWAyJyhWD7OHFezyelp+38X
6SDFM1kE7YTflOaoIMwA1EnKMLR2Wdhr/Hz9wqSo5QGB6woCcYA8mg0sHtA2Z3qv
E/6BaweT/OvRs7ncivaC5lW12kYYg1NH2DsbVo/29cVad80nJo7751q+J7p2m/dh
9oiok8hnIVr+6/GAOHfipeFMAMvI2fBiCdMWdlyGHtTMVTa/IsS/8AxCFQNK53HK
0jPmrnLNEq0tPAaE4K3PzcZV1cChSJWvA5urqlXusnqxWuCRQrl5XnDhkk8vfXeM
FIqmKUpl0zgVi2hXjhEOR50tnyk8xY4TBb7pKaNA1GRBzyVCJhwVUodnfMGFon8J
H4Fg2iN1WEfV6u8RSt7GrSSKTWsX5X+j3sjz1ITa+d2U+myL4NY=
=UdQ9
-----END PGP SIGNATURE-----
