{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "Fix CVE-2026-58050 (publickey.c attribute-count multiplication overflow),\n CVE-2026-58051 (publickey.c arbitrary free via uninitialised list entry)\n- Fix double-free of receive_packet in the publickey subsystem (no CVE,\n upstream 86301ab5 / #1699)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/el6/advisories/2026/clsa-2026_1791917724.json" } ], "tracking": { "current_release_date": "2026-10-13T18:56:40Z", "generator": { "date": "2026-10-13T18:56:40Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1791917724", "initial_release_date": "2026-10-13T18:56:40Z", "revision_history": [ { "date": "2026-10-13T18:56:40Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-libssh211: Fix of 6 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "product": { "name": "alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "product_id": "alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libssh211-devel@1.11.1-6.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-libssh211-0:1.11.1-6.el6.x86_64", "product": { "name": "alt-libssh211-0:1.11.1-6.el6.x86_64", "product_id": "alt-libssh211-0:1.11.1-6.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libssh211@1.11.1-6.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-libssh211-docs-0:1.11.1-6.el6.x86_64", "product": { "name": "alt-libssh211-docs-0:1.11.1-6.el6.x86_64", "product_id": "alt-libssh211-docs-0:1.11.1-6.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-libssh211-docs@1.11.1-6.el6?arch=x86_64&os_name=centos&os_version=6" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-libssh211-devel-0:1.11.1-6.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64" }, "product_reference": "alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libssh211-0:1.11.1-6.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64" }, "product_reference": "alt-libssh211-0:1.11.1-6.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-libssh211-docs-0:1.11.1-6.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" }, "product_reference": "alt-libssh211-docs-0:1.11.1-6.el6.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-7598", "notes": [ { "category": "description", "text": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-7598" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/", "url": "https://github.com/libssh2/libssh2/" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1", "url": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/pull/1858", "url": "https://github.com/libssh2/libssh2/pull/1858" }, { "category": "external", "summary": "https://vuldb.com/submit/805564", "url": "https://vuldb.com/submit/805564" }, { "category": "external", "summary": "https://vuldb.com/vuln/360555", "url": "https://vuldb.com/vuln/360555" }, { "category": "external", "summary": "https://vuldb.com/vuln/360555/cti", "url": "https://vuldb.com/vuln/360555/cti" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:16736", "url": "https://access.redhat.com/errata/RHSA-2026:16736" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:61752", "url": "https://access.redhat.com/errata/RHSA-2026:61752" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7021", "url": "https://access.redhat.com/errata/RHSA-2026:7021" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-7598", "url": "https://access.redhat.com/security/cve/CVE-2026-7598" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2464597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464597" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json" } ], "release_date": "2026-05-01T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-13T18:55:25.747199Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "product_ids": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-55199", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "description", "text": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-55199" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4", "url": "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/pull/1864", "url": "https://github.com/libssh2/libssh2/pull/1864" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler", "url": "https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler" } ], "release_date": "2026-06-17T20:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-13T18:55:25.747199Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "product_ids": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-58050", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-58050" }, { "category": "external", "summary": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc", "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c", "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation", "url": "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation" } ], "release_date": "2026-06-28T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-13T18:55:25.747199Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "product_ids": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-15661", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2025-15661" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d", "url": "https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/pull/1705", "url": "https://github.com/libssh2/libssh2/pull/1705" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/pull/1717", "url": "https://github.com/libssh2/libssh2/pull/1717" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c", "url": "https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c" } ], "release_date": "2026-06-18T21:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-13T18:55:25.747199Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "product_ids": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-55200", "cwe": { "id": "CWE-680", "name": "Integer Overflow to Buffer Overflow" }, "notes": [ { "category": "description", "text": "libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-55200" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8", "url": "https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/pull/2052", "url": "https://github.com/libssh2/libssh2/pull/2052" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c", "url": "https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c" }, { "category": "external", "summary": "https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc", "url": "https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc" } ], "release_date": "2026-06-17T20:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-13T18:55:25.747199Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "product_ids": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-58051", "cwe": { "id": "CWE-908", "name": "Use of Uninitialized Resource" }, "notes": [ { "category": "description", "text": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-58051" }, { "category": "external", "summary": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc", "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c", "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup", "url": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup" } ], "release_date": "2026-06-28T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-13T18:55:25.747199Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724", "product_ids": [ "CentOS-6:alt-libssh211-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-devel-0:1.11.1-6.el6.x86_64", "CentOS-6:alt-libssh211-docs-0:1.11.1-6.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1791917724" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }