Skip to content

Commit cbfcc95

Browse files
azurelinux-securitykevin-b-lockwoodmbykhovtsev-ms
authored
[AutoPR- Security] Patch libssh for CVE-2025-5987, CVE-2025-5372, CVE-2025-5351, CVE-2025-5318 (microsoft#14256)
Co-authored-by: Kevin Lockwood <[email protected]> Co-authored-by: Mykhailo Bykhovtsev <[email protected]>
1 parent 9b8d2e6 commit cbfcc95

File tree

5 files changed

+253
-1
lines changed

5 files changed

+253
-1
lines changed

‎SPECS/libssh/CVE-2025-5318.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 06b93128198f80c4bf5c98563bffdad5524ecb51 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 10 Jul 2025 14:55:12 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-5318 in libssh
6+
7+
[AI Backported] Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/commit/?id=5f4ffda88770f95482fd0e66aa44106614dbf466
8+
---
9+
src/sftpserver.c | 2 +-
10+
1 file changed, 1 insertion(+), 1 deletion(-)
11+
12+
diff --git a/src/sftpserver.c b/src/sftpserver.c
13+
index 9117f15..b3349e1 100644
14+
--- a/src/sftpserver.c
15+
+++ b/src/sftpserver.c
16+
@@ -538,7 +538,7 @@ void *sftp_handle(sftp_session sftp, ssh_string handle){
17+
18+
memcpy(&val, ssh_string_data(handle), sizeof(uint32_t));
19+
20+
- if (val > SFTP_HANDLES) {
21+
+ if (val >= SFTP_HANDLES) {
22+
return NULL;
23+
}
24+
25+
--
26+
2.45.3
27+

‎SPECS/libssh/CVE-2025-5351.patch‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 313681dd6494c3086489ae14957a496a2ba42456 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 10 Jul 2025 14:46:58 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-5351 in libssh
6+
7+
Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/patch/?id=6ddb730a27338983851248af59b128b995aad256
8+
---
9+
src/pki_crypto.c | 2 ++
10+
1 file changed, 2 insertions(+)
11+
12+
diff --git a/src/pki_crypto.c b/src/pki_crypto.c
13+
index 5b0d7de..aec4954 100644
14+
--- a/src/pki_crypto.c
15+
+++ b/src/pki_crypto.c
16+
@@ -2023,6 +2023,7 @@ ssh_string pki_publickey_to_blob(const ssh_key key)
17+
bignum_safe_free(bn);
18+
bignum_safe_free(be);
19+
OSSL_PARAM_free(params);
20+
+ params = NULL;
21+
#endif /* OPENSSL_VERSION_NUMBER */
22+
break;
23+
}
24+
@@ -2143,6 +2144,7 @@ ssh_string pki_publickey_to_blob(const ssh_key key)
25+
*/
26+
#if 0
27+
OSSL_PARAM_free(params);
28+
+ params = NULL;
29+
#endif /* OPENSSL_VERSION_NUMBER */
30+
31+
if (key->type == SSH_KEYTYPE_SK_ECDSA &&
32+
--
33+
2.45.3
34+

‎SPECS/libssh/CVE-2025-5372.patch‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
From 8a935478287196fc0428d82c3a2ebd4a1ecc133a Mon Sep 17 00:00:00 2001
2+
From: Jakub Jelen <[email protected]>
3+
Date: Wed, 14 May 2025 14:07:58 +0200
4+
Subject: [PATCH] CVE-2025-5372 libgcrypto: Simplify error checking and
5+
handling of return codes in ssh_kdf()
6+
7+
Upstream Patch Link: https://git.libssh.org/projects/libssh.git/commit/?id=a9d8a3d44829cf9182b252bc951f35fb0d573972
8+
9+
Signed-off-by: Jakub Jelen <[email protected]>
10+
Reviewed-by: Andreas Schneider <[email protected]>
11+
---
12+
src/libcrypto.c | 68 ++++++++++++++++++++++++-------------------------
13+
1 file changed, 34 insertions(+), 34 deletions(-)
14+
15+
diff --git a/src/libcrypto.c b/src/libcrypto.c
16+
index 911b363..f7d42ac 100644
17+
--- a/src/libcrypto.c
18+
+++ b/src/libcrypto.c
19+
@@ -163,7 +163,7 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
20+
uint8_t key_type, unsigned char *output,
21+
size_t requested_len)
22+
{
23+
- int rc = -1;
24+
+ int ret = SSH_ERROR, rv;
25+
#if OPENSSL_VERSION_NUMBER < 0x30000000L
26+
EVP_KDF_CTX *ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF);
27+
#else
28+
@@ -185,81 +185,81 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
29+
}
30+
31+
#if OPENSSL_VERSION_NUMBER < 0x30000000L
32+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
33+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
34+
sshkdf_digest_to_md(crypto->digest_type));
35+
- if (rc != 1) {
36+
+ if (rv != 1) {
37+
goto out;
38+
}
39+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, key_len);
40+
- if (rc != 1) {
41+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, key_len);
42+
+ if (rv != 1) {
43+
goto out;
44+
}
45+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
46+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
47+
crypto->secret_hash, crypto->digest_len);
48+
- if (rc != 1) {
49+
+ if (rv != 1) {
50+
goto out;
51+
}
52+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, key_type);
53+
- if (rc != 1) {
54+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, key_type);
55+
+ if (rv != 1) {
56+
goto out;
57+
}
58+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
59+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
60+
crypto->session_id, crypto->session_id_len);
61+
- if (rc != 1) {
62+
+ if (rv != 1) {
63+
goto out;
64+
}
65+
- rc = EVP_KDF_derive(ctx, output, requested_len);
66+
- if (rc != 1) {
67+
+ rv = EVP_KDF_derive(ctx, output, requested_len);
68+
+ if (rv != 1) {
69+
goto out;
70+
}
71+
#else
72+
- rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
73+
+ rv = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
74+
md, strlen(md));
75+
- if (rc != 1) {
76+
- rc = -1;
77+
+ if (rv != 1) {
78+
+ rv = -1;
79+
goto out;
80+
}
81+
- rc = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
82+
+ rv = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
83+
key, key_len);
84+
- if (rc != 1) {
85+
- rc = -1;
86+
+ if (rv != 1) {
87+
+ rv = -1;
88+
goto out;
89+
}
90+
- rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
91+
+ rv = OSSL_PARAM_BLD_push_octet_string(param_bld,
92+
OSSL_KDF_PARAM_SSHKDF_XCGHASH,
93+
crypto->secret_hash,
94+
crypto->digest_len);
95+
- if (rc != 1) {
96+
- rc = -1;
97+
+ if (rv != 1) {
98+
+ rv = -1;
99+
goto out;
100+
}
101+
- rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
102+
+ rv = OSSL_PARAM_BLD_push_octet_string(param_bld,
103+
OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
104+
crypto->session_id,
105+
crypto->session_id_len);
106+
- if (rc != 1) {
107+
- rc = -1;
108+
+ if (rv != 1) {
109+
+ rv = -1;
110+
goto out;
111+
}
112+
- rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_SSHKDF_TYPE,
113+
+ rv = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_SSHKDF_TYPE,
114+
(const char*)&key_type, 1);
115+
- if (rc != 1) {
116+
- rc = -1;
117+
+ if (rv != 1) {
118+
+ rv = -1;
119+
goto out;
120+
}
121+
122+
params = OSSL_PARAM_BLD_to_param(param_bld);
123+
if (params == NULL) {
124+
- rc = -1;
125+
+ rv = -1;
126+
goto out;
127+
}
128+
129+
- rc = EVP_KDF_derive(ctx, output, requested_len, params);
130+
- if (rc != 1) {
131+
- rc = -1;
132+
+ rv = EVP_KDF_derive(ctx, output, requested_len, params);
133+
+ if (rv != 1) {
134+
goto out;
135+
}
136+
#endif /* OPENSSL_VERSION_NUMBER */
137+
+ ret = SSH_OK;
138+
139+
out:
140+
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
141+
@@ -267,8 +267,8 @@ out:
142+
OSSL_PARAM_free(params);
143+
#endif
144+
EVP_KDF_CTX_free(ctx);
145+
- if (rc < 0) {
146+
- return rc;
147+
+ if (ret < 0) {
148+
+ return ret;
149+
}
150+
return 0;
151+
}
152+
--
153+
2.34.1
154+

‎SPECS/libssh/CVE-2025-5987.patch‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
From 58aa3e96f2ba827e02254434bdfacf0b595f5080 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 10 Jul 2025 14:55:18 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-5987 in libssh
6+
7+
[AI Backported] Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/commit/?id=90b4845e0c98574bbf7bea9e97796695f064bf57
8+
---
9+
src/libcrypto.c | 4 ++--
10+
1 file changed, 2 insertions(+), 2 deletions(-)
11+
12+
diff --git a/src/libcrypto.c b/src/libcrypto.c
13+
index 4f945d9..911b363 100644
14+
--- a/src/libcrypto.c
15+
+++ b/src/libcrypto.c
16+
@@ -777,9 +777,9 @@ chacha20_poly1305_set_key(struct ssh_cipher_struct *cipher,
17+
SSH_LOG(SSH_LOG_WARNING, "EVP_CIPHER_CTX_new failed");
18+
goto out;
19+
}
20+
- ret = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL,
21+
+ rv = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL,
22+
u8key + CHACHA20_KEYLEN, NULL);
23+
- if (ret != 1) {
24+
+ if (rv != 1) {
25+
SSH_LOG(SSH_LOG_WARNING, "EVP_CipherInit failed");
26+
goto out;
27+
}
28+
--
29+
2.45.3
30+

‎SPECS/libssh/libssh.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Vendor: Microsoft Corporation
22
Distribution: Mariner
33
Name: libssh
44
Version: 0.10.6
5-
Release: 1%{?dist}
5+
Release: 2%{?dist}
66
Summary: A library implementing the SSH protocol
77
License: LGPLv2+
88
URL: http://www.libssh.org
@@ -12,6 +12,10 @@ Source1: https://www.libssh.org/files/0.10/%{name}-%{version}.tar.xz.asc
1212
Source2: https://cryptomilk.org/gpgkey-8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D.gpg#/%{name}.keyring
1313
Source3: libssh_client.config
1414
Source4: libssh_server.config
15+
Patch0: CVE-2025-5987.patch
16+
Patch1: CVE-2025-5372.patch
17+
Patch2: CVE-2025-5351.patch
18+
Patch3: CVE-2025-5318.patch
1519

1620
BuildRequires: cmake
1721
BuildRequires: gcc-c++
@@ -144,6 +148,9 @@ popd
144148
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/libssh/libssh_server.config
145149

146150
%changelog
151+
* Thu Jul 10 2025 Azure Linux Security Servicing Account <[email protected]> - 0.10.6-2
152+
- Patch for CVE-2025-5987, CVE-2025-5372, CVE-2025-5351, CVE-2025-5318
153+
147154
* Fri Dec 29 2023 Neha Agarwal <[email protected]> - 0.10.6-1
148155
- Upgrade to 0.10.6 to fix CVE-2023-48795
149156

0 commit comments

Comments
 (0)