[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for libssh issues

Tue Jul 21 13:47:14 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
853d0241 by Salvatore Bonaccorso at 2026-07-21T14:46:46+02:00
Add Debian bug reference for libssh issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,11 +1,11 @@
 CVE-2026-15370 [Stack buffer overflow in SFTP server longname construction]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-15370.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=4f0c400929d3aa1f505c5545703107e1c26ba24c (libssh-0.12.1)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=770eafb74b23814815d1246249f5ce42fb92c7ba (libssh-0.12.1)
 CVE-2026-59842 [Information disclosure via short GSSAPI Curve25519 public key]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	[trixie] - libssh <not-affected> (Vulnerable code introduced later)
 	[bookworm] - libssh <not-affected> (Vulnerable code introduced later)
 	[bullseye] - libssh <not-affected> (Vulnerable code introduced later)
@@ -14,52 +14,52 @@ CVE-2026-59842 [Information disclosure via short GSSAPI Curve25519 public key]
 	NOTE: Introduced with: https://git.libssh.org/projects/libssh.git/commit/?id=88c2ea6752fab7b3da9cc4c51eaf632361a44080 (libssh-0.12.0)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=5568ae6c5a1adcb008d044985fe5f1d1567bc610 (libssh-0.12.1)
 CVE-2026-59843 [Denial of service via zero advertised channel packet size]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59843.txt
 	TODO: check fixing commit in libssh-0.12.1
 CVE-2026-59844 [Denial of service via oversized SFTP read length]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59844.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=2544f22733ffcd59a2e51e2950f80901d063b946 (libssh-0.12.1)
 CVE-2026-59845 [Denial of service via unchecked ProxyCommand fork() failure]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59845.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=53b8152623290c69657a6774d96888b876e6061f (libssh-0.12.1)
 CVE-2026-59846 [Information disclosure via ProxyCommand %r username expansion]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59846.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=2e74267b034f00e8e36c86440364f885cead5f45 (libssh-0.12.1)
 CVE-2026-59847 [Integrity downgrade via OpenSSL AES-GCM tag verification]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59847.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=c483a187354dfd96b16d3309a74f6d1cf82c2074 (libssh-0.12.1)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=d4847509b792d564d1935dbfea4ee1496ad3d3d9 (libssh-0.12.1)
 CVE-2026-59848 [Denial of service via SFTP responses with unknown request IDs]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59848.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=9563afc950f473daa355ca594e2e5f4d520460ac (libssh-0.12.1)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=e3dc89de9754790e49b26f03b70e8e4acc88bde8 (libssh-0.12.1)
 CVE-2026-59849 [Denial of service via automatic certificate authentication loop]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59849.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=d9fef838e27fc740f70d9b825c98b912f3e84b14 (libssh-0.12.1)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=2a40a20b4963e033c7c5a21e3dc5ea6572178a20 (libssh-0.12.1)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=a540e27659b08828ef61f2910a790f7cf2af9f8d (libssh-0.12.1)
 CVE-2026-59850 [Use-after-free via data callbacks on closed channels]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	NOTE: https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
 	NOTE: https://www.libssh.org/security/advisories/CVE-2026-59850.txt
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=7dfabb1fd213196c4912c314b418ff36c882ea54 (libssh-0.12.1)
 	NOTE: Fixed by: https://git.libssh.org/projects/libssh.git/commit/?id=7edddfc580970c821b1bd866c5f88854a8bfd70d (libssh-0.12.1)
 CVE-2026-59851 [Authentication bypass via missing GSSAPI principal check]
-	- libssh <unfixed>
+	- libssh <unfixed> (bug #1142537)
 	[trixie] - libssh <not-affected> (Vulnerable code introduced later)
 	[bookworm] - libssh <not-affected> (Vulnerable code introduced later)
 	[bullseye] - libssh <not-affected> (Vulnerable code introduced later)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/853d0241f6b44ec6dfd3760ac5a78e63e0208a1b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/853d0241f6b44ec6dfd3760ac5a78e63e0208a1b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260721/8e7b5b49/attachment-0001.htm>
