fix(cve): CVE-2026-59844 - sftpserver: Check SSH_FXP_READ length to prevent DoS - #9
Merged
Conversation
…revent DoS CVE: CVE-2026-59844 (medium) - 远程认证攻击者可以发送任意长度的 SSH_FXP_READ 请求（最高 4 GiB），导致 libssh SFTP 服务器分配过多内存 Upstream: https://www.libssh.org/files/0.11/libssh-0.11.5.tar.xz Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
Contributor
Author
|
/hold |
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
TAG Bot TAG: 0.11.3-1deepin13 |
…sue during encryption CVE: CVE-2026-59847 (medium) - Fix symmetric issue during encryption and tag verification of AES-GCM ciphers Upstream: https://git.libssh.org/projects/libssh/commit/06c6082df966ef69db19387cf2064fa053fca1ed Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
… unknown request IDs CVE: CVE-2026-59848 (medium) - This adds a new field to sftp_session_struct, containing a list of outstanding request IDs. An ID is added to the list when a request is constructed and removed when the corresponding request is received. If a client receives a response with an unknown request ID, it reports an error. Storing responses with unknown request IDs in the response queue could be abused by a malicious SFTP server which could deplete client memory this way. Upstream: https://gitlab.com/libssh/libssh-mirror/commit/26147eb4767937c797f97ff3b1b1663384232417 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…|cpy) CVE: CVE-2026-15370 (medium) - A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to ... Upstream: https://gitlab.com/libssh/libssh-mirror/-/commit/b2065f71c905d347b5e8dd7f8e24856807d71e99 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…() return code CVE: CVE-2026-59845 (medium) - CVE-2026-59845 socket: Properly check fork() return code Upstream: https://git.libssh.org/projects/libssh/commit/92b6fb9c5e2d1606e8f809fd884ab6dd4d3b7d45 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…DATA packets on closed channel CVE: CVE-2026-59850 (medium) - CVE-2026-59850: channels: Avoid processing DATA packets on closed channels Upstream: https://git.libssh.org/projects/libssh/commit/6edfb52b3b364577d2db0334c0514a977efceed2 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…aovid infinite loop CVE: CVE-2026-59849 (low) - 认证过程中证书迭代器在失败时未正确移动，可能导致无限循环 Upstream: https://gitlab.com/libssh/libssh-mirror/-/commit/1e8f1c397019ca5a60e2c4b6d3e6869672436165 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…from usernames CVE: CVE-2026-59846 (low) - 当攻击者可以在用户名中插入美元符号或反斜杠时，可能导致打印包含秘密的环境变量。这是 CVE-2023-6004 的补充修复。 Upstream: https://git.libssh.org/projects/libssh.git/commit/56ce3c193eb06af5bf3b07ec0b4c7308b5c72130 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…ead/sftp_async_read_begin
|
/integrate |
|
AutoIntegrationPr Bot |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-59844 (medium) - 远程认证攻击者可以发送任意长度的 SSH_FXP_READ 请求（最高 4 GiB），导致 libssh SFTP 服务器分配过多内存
Upstream: https://www.libssh.org/files/0.11/libssh-0.11.5.tar.xz
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-59847 (medium) - Fix symmetric issue during encryption and tag verification of AES-GCM ciphers
Upstream: https://git.libssh.org/projects/libssh/commit/06c6082df966ef69db19387cf2064fa053fca1ed
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-59848 (medium) - This adds a new field to sftp_session_struct, containing a list of outstanding request IDs. An ID is added to the list when a request is constructed and removed when the corresponding request is received. If a client receives a response with an unknown request ID, it reports an error. Storing responses with unknown request IDs in the response queue could be abused by a malicious SFTP server which could deplete client memory this way.
Upstream: https://gitlab.com/libssh/libssh-mirror/commit/26147eb4767937c797f97ff3b1b1663384232417
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-15370 (medium) - A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to ...
Upstream: https://gitlab.com/libssh/libssh-mirror/-/commit/b2065f71c905d347b5e8dd7f8e24856807d71e99
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-59845 (medium) - CVE-2026-59845 socket: Properly check fork() return code
Upstream: https://git.libssh.org/projects/libssh/commit/92b6fb9c5e2d1606e8f809fd884ab6dd4d3b7d45
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-59850 (medium) - CVE-2026-59850: channels: Avoid processing DATA packets on closed channels
Upstream: https://git.libssh.org/projects/libssh/commit/6edfb52b3b364577d2db0334c0514a977efceed2
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-59849 (low) - 认证过程中证书迭代器在失败时未正确移动，可能导致无限循环
Upstream: https://gitlab.com/libssh/libssh-mirror/-/commit/1e8f1c397019ca5a60e2c4b6d3e6869672436165
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-59846 (low) - 当攻击者可以在用户名中插入美元符号或反斜杠时，可能导致打印包含秘密的环境变量。这是 CVE-2023-6004 的补充修复。
Upstream: https://git.libssh.org/projects/libssh.git/commit/56ce3c193eb06af5bf3b07ec0b4c7308b5c72130
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b