CVS commit: pkgsrc/security/libssh

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Thu Jul 23 09:25:56 UTC 2026

Modified Files:
        pkgsrc/security/libssh: Makefile PLIST buildlink3.mk distinfo
        pkgsrc/security/libssh/patches: patch-tests_torture.c

Log Message:
libssh: update to 0.11.5.

Follow upstream version numbering again.

version 0.11.5 (released 2026-07-21)
 * Security:
   * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
   * CVE-2026-59843: Denial of service via zero advertised channel packet size
   * CVE-2026-59844: Denial of service via oversized SFTP read length
   * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
   * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
   * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
   * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
   * CVE-2026-59849: Denial of service via automatic certificate authentication loop
   * CVE-2026-59850: Use-after-free via data callbacks on closed channels
   * Zero-initialize every ssh_string
 * Compatibility:
   * Fix compatibility with C23 / gcc16
 * Bugfixes:
   * Fix multiple memory leaks, null checks, and error checks
   * Validate peer public key in DH key exchange
   * Avoid remote window overflow
   * Avoid off-by-one overflow during kbdint authentication
   * Avoid logging uninitialized sequence numbers
   * Avoid double conversion of SFTP version number
   * Send correct SFTP server version number
   * Avoid handling repeated SFTP INIT messages
   * Harmonize return values from SFTP server callbacks


To generate a diff of this commit:
cvs rdiff -u -r1.58 -r1.59 pkgsrc/security/libssh/Makefile
cvs rdiff -u -r1.23 -r1.24 pkgsrc/security/libssh/PLIST
cvs rdiff -u -r1.26 -r1.27 pkgsrc/security/libssh/buildlink3.mk
cvs rdiff -u -r1.35 -r1.36 pkgsrc/security/libssh/distinfo
cvs rdiff -u -r1.1 -r1.2 pkgsrc/security/libssh/patches/patch-tests_torture.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/libssh/Makefile
diff -u pkgsrc/security/libssh/Makefile:1.58 pkgsrc/security/libssh/Makefile:1.59
--- pkgsrc/security/libssh/Makefile:1.58        Tue Jun 23 09:52:56 2026
+++ pkgsrc/security/libssh/Makefile     Thu Jul 23 09:25:55 2026
@@ -1,14 +1,8 @@
-# $NetBSD: Makefile,v 1.58 2026/06/23 09:52:56 wiz Exp $
-#
-# history: upstream renamed 0.11 to 0.1.1;
-# we have to use the old-style convention so that version compares work.
-
-VER=           0.11.4
-DISTNAME=      libssh-${VER}
-PKGNAME=       libssh-0.114
-PKGREVISION=   2
+# $NetBSD: Makefile,v 1.59 2026/07/23 09:25:55 wiz Exp $
+
+DISTNAME=      libssh-0.11.5
 CATEGORIES=    security
-MASTER_SITES=  https://www.libssh.org/files/${VER:R}/
+MASTER_SITES=  https://www.libssh.org/files/${PKGVERSION_NOREV:R}/
 EXTRACT_SUFX=  .tar.xz
 
 MAINTAINER=    is%NetBSD.org@localhost

Index: pkgsrc/security/libssh/PLIST
diff -u pkgsrc/security/libssh/PLIST:1.23 pkgsrc/security/libssh/PLIST:1.24
--- pkgsrc/security/libssh/PLIST:1.23   Tue Mar 17 19:33:33 2026
+++ pkgsrc/security/libssh/PLIST        Thu Jul 23 09:25:55 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.23 2026/03/17 19:33:33 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.24 2026/07/23 09:25:55 wiz Exp $
 include/libssh/callbacks.h
 include/libssh/legacy.h
 include/libssh/libssh.h
@@ -13,5 +13,5 @@ lib/cmake/libssh/libssh-config-version.c
 lib/cmake/libssh/libssh-config.cmake
 lib/libssh.so
 lib/libssh.so.4
-lib/libssh.so.4.10.4
+lib/libssh.so.4.10.5
 lib/pkgconfig/libssh.pc

Index: pkgsrc/security/libssh/buildlink3.mk
diff -u pkgsrc/security/libssh/buildlink3.mk:1.26 pkgsrc/security/libssh/buildlink3.mk:1.27
--- pkgsrc/security/libssh/buildlink3.mk:1.26   Sat Apr 19 07:58:22 2025
+++ pkgsrc/security/libssh/buildlink3.mk        Thu Jul 23 09:25:55 2026
@@ -1,12 +1,11 @@
-# $NetBSD: buildlink3.mk,v 1.26 2025/04/19 07:58:22 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.27 2026/07/23 09:25:55 wiz Exp $
 
 BUILDLINK_TREE+=       libssh
 
 .if !defined(LIBSSH_BUILDLINK3_MK)
 LIBSSH_BUILDLINK3_MK:=
 
-BUILDLINK_API_DEPENDS.libssh+= libssh>=0.54
-BUILDLINK_ABI_DEPENDS.libssh+= libssh>=0.111nb1
+BUILDLINK_API_DEPENDS.libssh+= libssh>=0.11.5<0.100
 BUILDLINK_PKGSRCDIR.libssh?=   ../../security/libssh
 
 pkgbase := libssh

Index: pkgsrc/security/libssh/distinfo
diff -u pkgsrc/security/libssh/distinfo:1.35 pkgsrc/security/libssh/distinfo:1.36
--- pkgsrc/security/libssh/distinfo:1.35        Tue Mar 17 19:33:33 2026
+++ pkgsrc/security/libssh/distinfo     Thu Jul 23 09:25:55 2026
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.35 2026/03/17 19:33:33 bsiegert Exp $
+$NetBSD: distinfo,v 1.36 2026/07/23 09:25:55 wiz Exp $
 
-BLAKE2s (libssh-0.11.4.tar.xz) = d25e69defcccff547fac66700f8fd30d1af90c2a65a4be19d2be4ffad3ddba56
-SHA512 (libssh-0.11.4.tar.xz) = 00c7e1317dcca8feab07eb3d6feb7bbc74c563149173d439d618f431386c4ca1d6f258567ef0599f08275a3a165c04105568f55e6ed7f0fe1a88382e2ebdc850
-Size (libssh-0.11.4.tar.xz) = 626652 bytes
+BLAKE2s (libssh-0.11.5.tar.xz) = 8680a65333de0083ca40296c88ccca0c937b77821564353398ec0ed8995ceb7a
+SHA512 (libssh-0.11.5.tar.xz) = bf565de9a429d173c88a4b182c37efe242392751441e84bc30335ae95eeeb264fc2783744fbdc80267bd76a0cbb96ebef04b9d9b7f4a76890974e6ee05c14257
+Size (libssh-0.11.5.tar.xz) = 629716 bytes
 SHA1 (patch-CompilerChecks.cmake) = 8a650be5b69e956a0a54f54b71c4927ce685b8ca
 SHA1 (patch-examples_sshd__direct-tcpip.c) = 62de8625d58dbc03c38b0eb23f6e7f20a46e91de
 SHA1 (patch-tests_CMakeLists.txt) = b5baa8db2161d3f1c7aab317b2919de5dbca6e6a
-SHA1 (patch-tests_torture.c) = 2c70e9d827f15ec36a62e0d0f5dd98774f24f79e
+SHA1 (patch-tests_torture.c) = 39831812d1b7d16eaf0f6e4b867f4c453278afbd

Index: pkgsrc/security/libssh/patches/patch-tests_torture.c
diff -u pkgsrc/security/libssh/patches/patch-tests_torture.c:1.1 pkgsrc/security/libssh/patches/patch-tests_torture.c:1.2
--- pkgsrc/security/libssh/patches/patch-tests_torture.c:1.1    Mon Jan  6 12:04:13 2020
+++ pkgsrc/security/libssh/patches/patch-tests_torture.c        Thu Jul 23 09:25:56 2026
@@ -1,8 +1,8 @@
-$NetBSD: patch-tests_torture.c,v 1.1 2020/01/06 12:04:13 pho Exp $
+$NetBSD: patch-tests_torture.c,v 1.2 2026/07/23 09:25:56 wiz Exp $
 
 Fix build on NetBSD 8.1: Don't try to use PATH_MAX without #include <limits.h>
 
---- tests/torture.c.orig       2020-01-06 12:01:16.440174806 +0000
+--- tests/torture.c.orig       2026-07-16 10:56:26.000000000 +0000
 +++ tests/torture.c
 @@ -29,6 +29,7 @@
  #include <sys/stat.h>