Name: libssh
Version: 0.10.5
Release: 10
Summary: A library implementing the SSH protocol
License: LGPLv2+
URL: http://www.libssh.org
Source0: https://www.libssh.org/files/0.10/%{name}-%{version}.tar.xz
Source1: https://www.libssh.org/files/0.10/%{name}-%{version}.tar.xz.asc
Source2: https://cryptomilk.org/gpgkey-8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D.gpg#/%{name}.keyring
Patch1: backport-0001-CVE-2023-6004-torture_config-Allow-multiple-in-usern.patch
Patch2: backport-0002-CVE-2023-6004-config_parser-Allow-multiple-in-userna.patch
Patch3: backport-0003-CVE-2023-6004-options-Simplify-the-hostname-parsing-.patch
Patch4: backport-0004-CVE-2023-6004-misc-Add-function-to-check-allowed-cha.patch
Patch5: backport-0005-CVE-2023-6004-torture_misc-Add-test-for-ssh_check_ho.patch
Patch6: backport-0006-CVE-2023-6004-config_parser-Check-for-valid-syntax-o.patch
Patch7: backport-0007-CVE-2023-6004-torture_proxycommand-Add-test-for-prox.patch
Patch8: backport-0008-CVE-2023-6004-torture_misc-Add-test-for-ssh_is_ipadd.patch
Patch9: backport-0009-CVE-2023-6004-misc-Add-ipv6-link-local-check-for-an-.patch
Patch10: backport-0010-CVE-2023-6004-torture_misc-Add-tests-for-ipv6-link-l.patch
Patch11: backport-0011-CVE-2023-48795-client-side-mitigation.patch
Patch12: backport-0012-CVE-2023-48795-Server-side-mitigations.patch
Patch13: backport-0013-CVE-2023-48795-Strip-extensions-from-both-kex-lists-.patch
Patch14: backport-0014-CVE-2023-48795-tests-Adjust-calculation-to-strict-ke.patch
Patch15: backport-0015-CVE-2023-6918-kdf-Reformat.patch
Patch16: backport-0016-CVE-2023-6918-Remove-unused-evp-functions-and-types.patch
Patch17: backport-0017-CVE-2023-6918-Systematically-check-return-values-whe.patch
Patch18: backport-0018-CVE-2023-6918-kdf-Detect-context-init-failures.patch
Patch19: backport-0019-CVE-2023-6918-tests-Code-coverage-for-ssh_get_pubkey.patch
Patch20: backport-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch
Patch21: backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch
Patch22: backport-0021-CVE-2025-4877-prevent-integer-overflow-and-potential-OOB.patch
Patch23: backport-0022-CVE-2025-4878-Initialize-pointers-where-posibble.patch
Patch24: backport-0023-CVE-2025-4878-Properly-check-ret-to-avoid-NULL-dereference.patch
Patch25: backport-0024-CVE-2025-5351-avoid-double-free-on-low-memory-conditions.patch
Patch26: backport-0025-CVE-2025-5987-correctly-detect-failures-of-chacha-init.patch
Patch27: backport-0026-CVE-2025-5372-Simplify-error-checking-in-ssh_kdf.patch
Patch28: backport-0027-CVE-2025-8114-NULL-pointer-dereference-after-allocate-fail.patch
Patch29: backport-0028-CVE-2025-8277-adjust-packet-filter.patch
Patch30: backport-0029-CVE-2025-8277-fix-memory-leak-and-free-allocated-pubkeys.patch
Patch31: backport-0030-CVE-2025-8277-mbedtls-avoid-leaking-ecdh-keys.patch
Patch32: backport-CVE-2026-0968-Sanitize-input-handling-in-sftp_parse_longname.patch
Patch33: backport-CVE-2026-0968-test-Reproducer-for-invalid-longname.patch
Patch34: backport-CVE-2026-0967-match-Avoid-recursive-matching.patch
Patch35: backport-CVE-2026-0966-Avoid-heap-buffer-underflow-in-ssh_get_hexa.patch
Patch36: backport-CVE-2026-0966-tests-Test-coverage-for-ssh_get_hexa.patch
Patch37: backport-CVE-2026-0965-do-not-attempt-to-read-non-regular-conf-files.patch
Patch38: backport-CVE-2026-0964-Reject-invalid-paths-received-through-scp.patch
Patch39: backport-CVE-2025-14821-Fix-global-config-location-on-Windows.patch
Patch40: backport-CVE-2026-3731-out-of-bound-read-from-sftp-extensions.patch
BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel
BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server
BuildRequires: nmap-ncat
Recommends: crypto-policies
Provides: libssh_threads.so.4()(64bit)
%description
The ssh library was designed to be used by programmers needing a working SSH
implementation by the mean of a library. The complete control of the client is
made by the programmer. With libssh, you can remotely execute programs, transfer
files, use a secure and transparent tunnel for your remote programs. With its
Secure FTP implementation, you can play with remote files easily, without
third-party programs others than libcrypto (from openssl).
%package devel
Summary: Development files for %{name}
Requires: %{name}%{?_isa} = %{version}-%{release}
%description devel
The %{name}-devel package contains libraries and header files for developing
applications that use %{name}.
%package_help
%prep
gpgv2 --quiet --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
%autosetup -p1
%build
if test ! -e "obj"; then
mkdir obj
fi
pushd obj
%cmake .. \
-DUNIT_TESTING=ON \
%make_build VERBOSE=1
popd
%install
make DESTDIR=%{buildroot} install/fast -C obj
install -d -m755 %{buildroot}%{_sysconfdir}/libssh
pushd %{buildroot}%{_libdir}
for i in libssh.so*;
do
_target="${i}"
_link_name="${i%libssh*}libssh_threads${i##*libssh}"
if [ -L "${i}" ]; then
_target="$(readlink ${i})"
fi
ln -s "${_target}" "${_link_name}"
done;
popd
%ldconfig_scriptlets
%check
pushd obj
ctest --output-on-failure
popd
%files
%defattr(-,root,root)
%doc AUTHORS BSD
%license COPYING
%{_libdir}/*.so.4*
%files devel
%defattr(-,root,root)
%{_includedir}/libssh/
%{_libdir}/cmake/libssh/
%{_libdir}/pkgconfig/libssh.pc
%{_libdir}/*.so
%files help
%defattr(-,root,root)
%doc CHANGELOG README
%changelog
* Tue Mar 10 2026 zhaoheqi <zhaoheqi@xfusion.com> - 0.10.5-10
- Type:CVE
- Id:NA
- SUG:NA
- DESC:fix CVE-2026-3731
* Sat Feb 14 2026 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-9
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821
* Wed Sep 24 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-8
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:fix CVE number in changelog
* Thu Sep 18 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-7
- Type:CVE
- Id:CVE-2025-8277
- SUG:NA
- DESC:fix CVE-2025-8277
* Mon Sep 15 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-6
- Type:CVE
- Id:CVE-2025-8114
- SUG:NA
- DESC:fix CVE-2025-8114
* Mon Aug 18 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5
- Type:CVE
- Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372
- SUG:NA
- DESC:fix CVE-2025-4877CVE-2025-4878CVE-2025-5351CVE-2025-5987CVE-2025-5372
* Wed Jul 2 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-4
- Type:CVE
- Id:CVE-2025-5318
- SUG:NA
- DESC:fix CVE-2025-5318
* Tue Oct 29 2024 bitianyuan <bitianyuan@huawei.com> - 0.10.5-3
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:Fix regression in IPv6 addresses in hostname parsing
* Thu Jan 4 2024 renmingshuai <renmingshuai@huawei.com> - 0.10.5-2
- Type:CVE
- Id:CVE-2023-6004,CVE-2023-48795,CVE-2023-6918
- SUG:NA
- DESC:fix CVE-2023-6004,CVE-2023-48795 and CVE-2023-6918
* Mon Aug 7 2023 renmingshuai <renmingshuai@huawei.com> - 0.10.5-1
- Type:requirement
- Id:NA
- SUG:NA
- DESC:update to 0.10.5
* Wed May 24 2023 renmingshuai <renmingshuai@huawei.com> - 0.10.4-4
- Type:CVE
- Id:CVE-2023-1667,CVE-2023-2283
- SUG:NA
- DESC:fix CVE-2023-1667 and CVE-2023-2283
* Mon Apr 3 2023 Chenxi Mao <chenxi.mao@suse.com> - 0.10.4-3
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:Backport patches to fix build error if compiler switch to clang.
* Sat Mar 18 2023 renmingshuai <renmingshuai@huawei.com> - 0.10.4-2
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:config: Escape brackets in ProxyCommand build from ProxyJump
packet: do not enqueue outgoing packets after sending
* Thu Oct 20 2022 zengweifeng<zwfeng@huawei.com> - 0.10.4-1
- Type:requirement
- Id:NA
- SUG:NA
- DESC:update to 0.10.4
* Thu Oct 20 2022 zengweifeng<zwfeng@huawei.com> - 0.9.6-5
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:avoid false positive report from Coveritt CID 1470006
kdf: Avoid endianess issues
misc: Fix format truncation in ssh_path_expand_escape()
misc: Fix expanding port numbers
misc: rename gettimeofday symbol
session: Initialize the port with the standard port (22)
session->socket_callbacks.data will be set to ssh_packet_socket_callback
socket: Add error message if execv fails
tests: Add test for expanding port numbers
* Thu Oct 13 2022 xinghe <xinghe2@h-partners.com> - 0.9.6-4
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:options: Parse hostname by last '@'
torture_options: Add test for '@' in login name
session: Initialize pointers
tests: Ensure the mode of the created file is what we set
* Fri Sep 02 2022 gaihuiying <eaglegai@163.com> - 0.9.6-3
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:backport upstream patches
* Wed Mar 16 2022 xihaochen <xihaochen@h-partners.com> - 0.9.6-2
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:remove obsolete lib
* Fri Dec 03 2021 gaihuiying <gaihuiying1@huawei.com> - 0.9.6-1
- Type:requirement
- Id:NA
- SUG:NA
- DESC:update libssh to 0.9.6
* Mon Sep 13 2021 heyaohua<heyaohua1@huawei.com> - 0.9.5-2
- Type:CVE
- Id:CVE-2021-3634
- SUG:NA
- DESC:fix CVE-2021-3634
* Fri Jan 29 2021 xihaochen <xihaochen@huawei.com> - 0.9.5-1
- Type:requirements
- Id:NA
- SUG:NA
- DESC:update libssh to 0.9.5
* Thu Aug 6 2020 zhaowei <zhaowei23@huawei.com> - 0.9.4-2
- Type:CVE
- Id:CVE-2020-16135
- SUG:NA
- DESC:fix CVE-2020-16135
* Mon Apr 20 2020 openEuler Buildteam <buildteam@openeuler.org> - 0.9.4-1
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:update to 0.9.4
* Sun Jan 12 2020 openEuler Buildteam <buildteam@openeuler.org> - 0.8.3-7
- Type:bugfix
- Id:NA
- SUG:NA
- DESC:bugfix in build process
* Sun Jan 12 2020 openEuler Buildteam <buildteam@openeuler.org> - 0.8.3-6
- Type:bugfix
- Id:NA
- SUG:NA
- DESC: fixes cves
* Sat Dec 21 2019 openEuler Buildteam <buildteam@openeuler.org> - 0.8.3-5
- Type:bugfix
- Id:NA
- SUG:NA
- DESC: fixes the oss fuzz bug
* Thu Sep 12 2019 openEuler Buildteam <buildteam@openeuler.org> - 0.8.3-4
- Package init