{"app_name":"Debian Janitor","binary_packages":["libssh2-1-dev","libssh2-1t64-dbgsym","libssh2-1t64"],"branch_url":"git+ssh://git@salsa.debian.org/debian/libssh2.git","build_distribution":"sid","build_log_highlight_lines":[1017],"build_log_include_lines":[1002,1032],"build_log_line_count":2827,"build_log_name":"build.log","campaign":"control","change_set":"8b6bed3f-75e9-40df-97aa-8455b8c61c38","codebase":"libssh2","codemod_log_name":"codemod.log","command":"brz up '--revision=git-v1:b38cbc31c61d552fb997706356585cbb112c426a'","current_year":"2026","description":"","is_admin":false,"lintian_result":{"groups":[{"group_id":"libssh2_1.11.1-2~jan+control1","input_files":[{"hints":[{"experimental":false,"note":"control != sid","pointer":{"item":{"index":"libssh2-1-dev_1.11.1-2~jan+control1_amd64.deb (installed)","name":"usr/share/doc/libssh2-1-dev/changelog.Debian.gz"},"line_position":1},"tag":"changelog-distribution-does-not-match-changes-file","visibility":"warning"}],"path":"libssh2-1-dev_1.11.1-2~jan+control1_amd64.deb"},{"hints":[],"path":"libssh2-1t64-dbgsym_1.11.1-2~jan+control1_amd64.deb"},{"hints":[{"experimental":false,"note":"control != sid","pointer":{"item":{"index":"libssh2-1t64_1.11.1-2~jan+control1_amd64.deb (installed)","name":"usr/share/doc/libssh2-1t64/changelog.Debian.gz"},"line_position":1},"tag":"changelog-distribution-does-not-match-changes-file","visibility":"warning"}],"path":"libssh2-1t64_1.11.1-2~jan+control1_amd64.deb"},{"hints":[{"experimental":false,"note":"","pointer":{"item":{"index":"libssh2_1.11.1-2~jan+control1.dsc (patched)","name":"debian/changelog"},"line_position":1},"tag":"no-nmu-in-changelog","visibility":"warning"},{"experimental":false,"note":"libssh2_1.11.1.orig.tar.gz","tag":"orig-tarball-missing-upstream-signature","visibility":"warning"},{"experimental":false,"note":"1.11.1-2~jan+control1","pointer":{"item":{"index":"libssh2_1.11.1-2~jan+control1.dsc (patched)","name":"debian/changelog"},"line_position":1},"tag":"source-nmu-has-incorrect-version-number","visibility":"warning"}],"path":"libssh2_1.11.1-2~jan+control1.dsc"},{"hints":[],"path":"libssh2_1.11.1-2~jan+control1_amd64.buildinfo"},{"hints":[{"experimental":false,"note":"sid control","tag":"distribution-and-changes-mismatch","visibility":"warning"}],"path":"libssh2_1.11.1-2~jan+control1_amd64.changes"}],"source_name":"libssh2","source_version":"1.11.1-2~jan+control1"}],"lintian_version":"2.143.0"},"logs":{"build":{"description":"build","name":"build.log","url":"/control/c/libssh2/8b6bed3f-75e9-40df-97aa-8455b8c61c38/logs/build.log"},"codemod":{"description":"codemod","name":"codemod.log","url":"/control/c/libssh2/8b6bed3f-75e9-40df-97aa-8455b8c61c38/logs/codemod.log"},"worker":{"content":"[2026-11-08T02:14:22Z INFO janitor_worker] Opening branch at https://salsa.debian.org/debian/libssh2.git\n[2026-11-08T02:14:25Z INFO janitor_worker] Cached branch URL http://janitor.debian.net/git/libssh2 missing: http://janitor.debian.net/git/libssh2/\n[2026-11-08T02:14:25Z DEBUG janitor_worker] Workspace path: /srv/worker/output/1/janitor-worker-FADptV/libssh2\n[2026-11-08T02:14:25Z DEBUG silver_platter::workspace] Creating sprout from git+ssh://git@salsa.debian.org/debian/libssh2.git\nTotal 4190 (delta 269), reused 455 (delta 165), pack-reused 3569 (from 1)\n\n[2026-11-08T02:14:29Z DEBUG silver_platter::utils] Colocated branch experimental not found, skipping\n[2026-11-08T02:14:29Z DEBUG silver_platter::utils] Colocated branch vendor not found, skipping\nTotal 106 (delta 26), reused 106 (delta 26), pack-reused 0 (from 0)\nTotal 0 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)\nNothing to delete.\n[2026-11-08T02:14:36Z DEBUG silver_platter::workspace] Fetching colocated branches: {\"pristine-tar\": \"pristine-tar\", \"experimental\": \"experimental\", \"vendor\": \"vendor\", \"upstream\": \"upstream\"}\nTotal 0 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)\n[2026-11-08T02:14:39Z DEBUG silver_platter::workspace] Successfully fetched colocated branch pristine-tar -> pristine-tar\nTotal 0 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)\n[2026-11-08T02:14:41Z DEBUG silver_platter::workspace] Successfully fetched colocated branch upstream -> upstream\n[2026-11-08T02:14:41Z INFO janitor_worker] Workspace ready - starting.\n[2026-11-08T02:14:41Z INFO janitor_worker::debian] Running [\"brz\", \"up\", \"--revision=git-v1:b38cbc31c61d552fb997706356585cbb112c426a\"]\n[2026-11-08T02:14:44Z DEBUG debian_analyzer::detect_gbp_dch] Branch history analysis: changelog_only: 6, other_only: 10, mixed: 28, dch_references: 0, unreleased_references: 8\nfound 2814 deltas to reuse\n(1801/2814)\n[2026-11-08T02:14:48Z INFO ognibuild::debian::fix_build] Using fixers: [PgBuildExtOutOfDateControlFixer, MissingConfigureFixer, MissingAutomakeInputFixer, MissingConfigStatusInputFixer, MissingPerlFileFixer, DebcargoUnacceptablePredicateFixer, DebcargoUnacceptableComparatorFixer, RetryAptFetchFailure, PackageDependencyFixer]\n[2026-11-08T02:14:48Z DEBUG ognibuild::debian::build] Adding dummy changelog entry 1.11.1-2~jan+control1 for build\n[2026-11-08T02:14:48Z DEBUG ognibuild::debian::build] Writing build log to /srv/worker/output/1/janitor-worker-FADptV/build.log\n[2026-11-08T02:14:48Z INFO ognibuild::debian::build] Building debian packages, running sbuild --chroot-mode=unshare --no-clean-source -A -s -v -d sid.\n[2026-11-08T02:21:04Z INFO ognibuild::debian::build] Build succeeded.\n[2026-11-08T02:21:04Z INFO janitor_worker::debian::build] Built [\"/srv/worker/output/1/janitor-worker-FADptV/libssh2_1.11.1-2~jan+control1_amd64.buildinfo\", \"/srv/worker/output/1/janitor-worker-FADptV/libssh2_1.11.1-2~jan+control1_amd64.changes\"].\n[2026-11-08T02:21:04Z DEBUG janitor_worker::debian::lintian] Running lintian: cd \"/srv/worker/output/1/janitor-worker-FADptV\" && \"lintian\" \"--exp-output=format=json\" \"--allow-root\" \"/srv/worker/output/1/janitor-worker-FADptV/libssh2_1.11.1-2~jan+control1_amd64.buildinfo\" \"/srv/worker/output/1/janitor-worker-FADptV/libssh2_1.11.1-2~jan+control1_amd64.changes\"\n[2026-11-08T02:21:19Z INFO janitor_worker] Pushing result branch to http://janitor.debian.net/git/libssh2\nfound 0 deltas to reuse\n[2026-11-08T02:21:20Z INFO janitor_worker::vcs] Pushing packaging branch cache to http://janitor.debian.net/git/libssh2,branch=debian%2Flatest\nfound 25 deltas to reuse\n[2026-11-08T02:21:20Z INFO janitor_worker::vcs] Pushed packaging branch cache to http://janitor.debian.net/git/libssh2,branch=debian%2Flatest\n","description":"worker","name":"worker.log","url":"/control/c/libssh2/8b6bed3f-75e9-40df-97aa-8455b8c61c38/logs/worker.log"}},"my_review":null,"other_reviews":[],"primary_log":"worker","publish_history":[],"queue_position":1,"result_code":"success","resume_from":null,"reviews":[],"revision":"git-v1:b38cbc31c61d552fb997706356585cbb112c426a","run":{"branch_url":"git+ssh://git@salsa.debian.org/debian/libssh2.git","build_version":null,"change_set":"8b6bed3f-75e9-40df-97aa-8455b8c61c38","codebase":"libssh2","command":"brz up '--revision=git-v1:b38cbc31c61d552fb997706356585cbb112c426a'","context":null,"debian_build_distribution":"sid","debian_build_version":null,"description":"","duration_seconds":421,"failure_stage":null,"failure_transient":null,"finish_time":"2026-11-08T02:21:21.772439Z","id":"8b6bed3f-75e9-40df-97aa-8455b8c61c38","logfilenames":["worker.log","codemod.log","build.log"],"main_branch_revision":"git-v1:22a10fa8d045b5fe3ae5d37532c046ff6ef108a3","publish_status":"unknown","result_branches":[{"absorbed":false,"base_revision":"git-v1:22a10fa8d045b5fe3ae5d37532c046ff6ef108a3","diff":"diff --git a/debian/changelog b/debian/changelog\nindex 1e57bf4..41f71c8 100644\n--- a/debian/changelog\n+++ b/debian/changelog\n@@ -1,33 +1,3 @@\n-libssh2 (1.11.1-6) unstable; urgency=medium\n-\n- * d/patches: Fix CVEs CVE-2026-58050 CVE-2026-58051 (Closes: #1144415)\n-\n- -- Nicolas Mora Sat, 15 Aug 2026 09:17:51 -0400\n-\n-libssh2 (1.11.1-5) unstable; urgency=medium\n-\n- * d/patches: Fix CVEs CVE-2026-66032 CVE-2026-66033 CVE-2026-66034\n- CVE-2026-66035 (Closes: #1142856)\n- * d/control: Upgrade debhelper-compat version to 14\n-\n- -- Nicolas Mora Mon, 27 Jul 2026 07:32:55 -0400\n-\n-libssh2 (1.11.1-4) unstable; urgency=medium\n-\n- [ Moritz Mühlenhoff ]\n- * d/patches: Fix CVEs CVE-2025-15661 CVE-2026-55199 CVE-2026-55200\n- (Closes: #1140401)\n-\n- -- Nicolas Mora Wed, 24 Jun 2026 09:10:36 -0400\n-\n-libssh2 (1.11.1-3) unstable; urgency=medium\n-\n- * d/patches: Fix integer overflow in userauth_password\n- Fixes CVE-2026-7598 (Closes: #1135647)\n- * d/control: Update standards version to 4.7.4\n-\n- -- Nicolas Mora Mon, 04 May 2026 07:35:17 -0400\n-\n libssh2 (1.11.1-2) unstable; urgency=medium\n \n * Fix ftbfs, thanks Collin Watson (Closes: #1129134)\ndiff --git a/debian/control b/debian/control\nindex 4dc05db..2b7f22c 100644\n--- a/debian/control\n+++ b/debian/control\n@@ -2,11 +2,11 @@ Source: libssh2\n Section: libs\n Maintainer: Nicolas Mora \n Build-Depends: dpkg-dev (>= 1.22.5)\n- , debhelper-compat (= 14)\n+ , debhelper-compat (= 13)\n , dh-sequence-installsysusers\n , libssl-dev\n , zlib1g-dev\n-Standards-Version: 4.7.4\n+Standards-Version: 4.7.3\n Homepage: https://libssh2.org/\n Vcs-Browser: https://salsa.debian.org/debian/libssh2\n Vcs-Git: https://salsa.debian.org/debian/libssh2.git\ndiff --git a/debian/patches/CVE-2025-15661.patch b/debian/patches/CVE-2025-15661.patch\ndeleted file mode 100644\nindex 8e3ab28..0000000\n--- a/debian/patches/CVE-2025-15661.patch\n+++ /dev/null\n@@ -1,111 +0,0 @@\n-From 2dae3024897e1898d389835151f4e9606227721d Mon Sep 17 00:00:00 2001\n-From: Will Cosgrove \n-Date: Fri, 10 Oct 2025 08:26:20 -0700\n-Subject: [PATCH] Update sftp_symlink to avoid out of bounds read on malformed\n- packet #1705 (#1717)\n-\n---- libssh2-1.11.1.orig/src/sftp.c\n-+++ libssh2-1.11.1/src/sftp.c\n-@@ -3795,15 +3795,19 @@ static int sftp_symlink(LIBSSH2_SFTP *sf\n- {\n- LIBSSH2_CHANNEL *channel = sftp->channel;\n- LIBSSH2_SESSION *session = channel->session;\n-- size_t data_len = 0, link_len;\n-+ size_t data_len = 0, lk_len;\n- /* 13 = packet_len(4) + packet_type(1) + request_id(4) + path_len(4) */\n- ssize_t packet_len =\n- path_len + 13 +\n- ((link_type == LIBSSH2_SFTP_SYMLINK) ? (4 + target_len) : 0);\n- unsigned char *s, *data = NULL;\n-+ struct string_buf buf;\n- static const unsigned char link_responses[2] =\n- { SSH_FXP_NAME, SSH_FXP_STATUS };\n- int retcode;\n-+ unsigned char packet_type;\n-+ uint32_t tmp_u32;\n-+ unsigned char *lk_target;\n- \n- if(sftp->symlink_state == libssh2_NB_state_idle) {\n- sftp->last_errno = LIBSSH2_FX_OK;\n-@@ -3891,8 +3895,25 @@ static int sftp_symlink(LIBSSH2_SFTP *sf\n- \n- sftp->symlink_state = libssh2_NB_state_idle;\n- \n-- if(data[0] == SSH_FXP_STATUS) {\n-- retcode = _libssh2_ntohu32(data + 5);\n-+ buf.data = (unsigned char *)LIBSSH2_UNCONST(data);\n-+ buf.dataptr = buf.data;\n-+ buf.len = data_len;\n-+\n-+ if(_libssh2_get_byte(&buf, &packet_type)) {\n-+ LIBSSH2_FREE(session, data);\n-+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,\n-+ \"SFTP Protocol Error (type)\");\n-+ }\n-+\n-+ if(packet_type == SSH_FXP_STATUS) {\n-+ if(_libssh2_get_u32(&buf, &tmp_u32)) {\n-+ LIBSSH2_FREE(session, data);\n-+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,\n-+ \"SFTP Protocol Error (code)\");\n-+ }\n-+\n-+ retcode = (int)tmp_u32;\n-+\n- LIBSSH2_FREE(session, data);\n- if(retcode == LIBSSH2_FX_OK)\n- return LIBSSH2_ERROR_NONE;\n-@@ -3903,30 +3924,37 @@ static int sftp_symlink(LIBSSH2_SFTP *sf\n- }\n- }\n- \n-- if(_libssh2_ntohu32(data + 5) < 1) {\n-+ /* advance past id */\n-+ if(_libssh2_get_u32(&buf, &tmp_u32)) {\n- LIBSSH2_FREE(session, data);\n- return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,\n-- \"Invalid READLINK/REALPATH response, \"\n-- \"no name entries\");\n-+ \"SFTP Protocol Error (id)\");\n- }\n- \n-- if(data_len < 13) {\n-- if(data_len > 0) {\n-- LIBSSH2_FREE(session, data);\n-- }\n-+ /* look for at least one link */\n-+ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {\n-+ LIBSSH2_FREE(session, data);\n- return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,\n-- \"SFTP stat packet too short\");\n-+ \"Invalid READLINK/REALPATH response, \"\n-+ \"no name entries\");\n- }\n- \n-- /* this reads a u32 and stores it into a signed 32bit value */\n-- link_len = _libssh2_ntohu32(data + 9);\n-- if(link_len < target_len) {\n-- memcpy(target, data + 13, link_len);\n-- target[link_len] = 0;\n-- retcode = (int)link_len;\n-+ if(_libssh2_get_string(&buf, &lk_target, &lk_len) == LIBSSH2_ERROR_NONE) {\n-+ if(lk_len < target_len) {\n-+ memcpy(target, lk_target, lk_len);\n-+ target[lk_len] = '\\0';\n-+ retcode = (int)lk_len;\n-+ }\n-+ else {\n-+ retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;\n-+ }\n- }\n-- else\n-- retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;\n-+ else {\n-+ LIBSSH2_FREE(session, data);\n-+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,\n-+ \"SFTP Protocol Error (filename)\");\n-+ }\n-+\n- LIBSSH2_FREE(session, data);\n- \n- return retcode;\ndiff --git a/debian/patches/CVE-2026-55199.patch b/debian/patches/CVE-2026-55199.patch\ndeleted file mode 100644\nindex 5ef23ee..0000000\n--- a/debian/patches/CVE-2026-55199.patch\n+++ /dev/null\n@@ -1,21 +0,0 @@\n-From 17626857d20b3c9a1addfa45979dadcee1cd84a4 Mon Sep 17 00:00:00 2001\n-From: TristanInSec \n-Date: Wed, 15 Apr 2026 14:51:08 -0400\n-Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`\n- handler\n-\n---- libssh2-1.11.1.orig/src/packet.c\n-+++ libssh2-1.11.1/src/packet.c\n-@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * se\n- \n- nr_extensions -= 1;\n- \n-- _libssh2_get_string(&buf, &name, &name_len);\n-- _libssh2_get_string(&buf, &value, &value_len);\n-+ if(_libssh2_get_string(&buf, &name, &name_len))\n-+ break;\n-+ if(_libssh2_get_string(&buf, &value, &value_len))\n-+ break;\n- \n- if(name && value) {\n- _libssh2_debug((session,\ndiff --git a/debian/patches/CVE-2026-55200.patch b/debian/patches/CVE-2026-55200.patch\ndeleted file mode 100644\nindex 0adb94c..0000000\n--- a/debian/patches/CVE-2026-55200.patch\n+++ /dev/null\n@@ -1,22 +0,0 @@\n-From 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Mon Sep 17 00:00:00 2001\n-From: Will Cosgrove \n-Date: Fri, 12 Jun 2026 15:57:44 -0700\n-Subject: [PATCH] transport.c: Additional boundary checks for packet length\n- (#2052)\n-\n---- libssh2-1.11.1.orig/src/transport.c\n-+++ libssh2-1.11.1/src/transport.c\n-@@ -639,8 +639,12 @@ int _libssh2_transport_read(LIBSSH2_SESS\n- total_num = 4;\n- \n- p->packet_length = _libssh2_ntohu32(block);\n-- if(p->packet_length < 1)\n-+ if(p->packet_length < 1) {\n- return LIBSSH2_ERROR_DECRYPT;\n-+ }\n-+ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {\n-+ return LIBSSH2_ERROR_OUT_OF_BOUNDARY;\n-+ }\n- \n- /* total_num may include size field, however due to existing\n- * logic it needs to be removed after the entire packet is read\ndiff --git a/debian/patches/CVE-2026-58050.patch b/debian/patches/CVE-2026-58050.patch\ndeleted file mode 100644\nindex 02292ad..0000000\n--- a/debian/patches/CVE-2026-58050.patch\n+++ /dev/null\n@@ -1,34 +0,0 @@\n-From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001\n-From: Viktor Szakats \n-Date: Sun, 28 Jun 2026 02:12:52 +0200\n-Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit\n- `libssh2_publickey_list_fetch()`\n-\n-Cap list size at 1024 elements.\n-\n-Reported-and-initial-patch-by: Mateusz Gierblinski\n-Reported-and-initial-patch-by: Behzod Abdullayev\n-Reported-by: Sharique Raza\n-\n-Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9\n-\n-Closes #2128\n-Forwarded: not-needed\n----\n- src/publickey.c | 5 +++++\n- 1 file changed, 5 insertions(+)\n-\n---- a/src/publickey.c\n-+++ b/src/publickey.c\n-@@ -1121,6 +1121,11 @@\n- }\n- \n- if(list[keys].num_attrs) {\n-+ if(list[keys].num_attrs > 1024) {\n-+ _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,\n-+ \"Too many publickey attributes\");\n-+ goto err_exit;\n-+ }\n- list[keys].attrs =\n- LIBSSH2_ALLOC(session,\n- list[keys].num_attrs *\ndiff --git a/debian/patches/CVE-2026-58051.patch b/debian/patches/CVE-2026-58051.patch\ndeleted file mode 100644\nindex 55ff709..0000000\n--- a/debian/patches/CVE-2026-58051.patch\n+++ /dev/null\n@@ -1,25 +0,0 @@\n-From 32092f0d310f4d769e5ed073ad5987f997f446dc Mon Sep 17 00:00:00 2001\n-From: Viktor Szakats \n-Date: Sun, 28 Jun 2026 02:13:32 +0200\n-Subject: [PATCH] publickey: fix potential arbitrary free in\n- `libssh2_publickey_list_fetch()`\n-\n-Due to uninitialized list entry.\n-\n-Reported-and-patch-by: Behzod Abdullayev\n-Reported-by: Sharique Raza\n-Forwarded: not-needed\n----\n- src/publickey.c | 1 +\n- 1 file changed, 1 insertion(+)\n-\n---- a/src/publickey.c\n-+++ b/src/publickey.c\n-@@ -972,6 +972,7 @@\n- goto err_exit;\n- }\n- list = newlist;\n-+ memset(&list[keys], 0, sizeof(list[keys]));\n- }\n- if(pkey->version == 1) {\n- unsigned long comment_len;\ndiff --git a/debian/patches/CVE-2026-66032.patch b/debian/patches/CVE-2026-66032.patch\ndeleted file mode 100644\nindex 4e84a98..0000000\n--- a/debian/patches/CVE-2026-66032.patch\n+++ /dev/null\n@@ -1,24 +0,0 @@\n-From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001\n-From: Will Cosgrove \n-Date: Thu, 2 Jul 2026 11:00:23 -0700\n-Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)\n-\n-Set data to NULL after freeing it to avoid dangling pointer. fixes\n-GHSA-px3w-7g75-hg7w.\n-\n-Credit: VladimirEliTokarev\n-Forwarded: not-needed\n----\n- src/sftp.c | 1 +\n- 1 file changed, 1 insertion(+)\n-\n---- a/src/sftp.c\n-+++ b/src/sftp.c\n-@@ -1279,6 +1279,7 @@\n- \"got HANDLE FXOK\"));\n- \n- LIBSSH2_FREE(session, data);\n-+ data = NULL;\n- \n- /* silly situation, but check for a HANDLE */\n- rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,\ndiff --git a/debian/patches/CVE-2026-66033.patch b/debian/patches/CVE-2026-66033.patch\ndeleted file mode 100644\nindex a312ac8..0000000\n--- a/debian/patches/CVE-2026-66033.patch\n+++ /dev/null\n@@ -1,40 +0,0 @@\n-From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001\n-From: Viktor Szakats \n-Date: Thu, 23 Jul 2026 10:32:04 +0200\n-Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in\n- `ssh2_cipher_crypt()`\n-\n-By applying two bounds checks to non-debug builds.\n-\n-Reported-by: Vladimir Eli Tokarev\n-Fixes GHSA-c4f7-cvfc-33j7\n-Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797\n-\n-Closes #2401\n-Forwarded: not-needed\n----\n- src/openssl.c | 10 ++++++----\n- 1 file changed, 6 insertions(+), 4 deletions(-)\n-\n---- a/src/openssl.c\n-+++ b/src/openssl.c\n-@@ -1042,13 +1042,15 @@\n- const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;\n- /* size of AT, if present */\n- const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;\n-- /* length to encrypt */\n-- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;\n-+ unsigned int cryptlen; /* length to encrypt */\n- \n- (void)algo;\n- \n-- assert(blocksize <= sizeof(buf));\n-- assert(cryptlen >= 0);\n-+ if(blocksize > sizeof(buf) ||\n-+ blocksize < (size_t)(aadlen + authenticationtag))\n-+ return 1;\n-+\n-+ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;\n- \n- #if LIBSSH2_AES_GCM\n- /* First block */\ndiff --git a/debian/patches/CVE-2026-66034.patch b/debian/patches/CVE-2026-66034.patch\ndeleted file mode 100644\nindex c0d06df..0000000\n--- a/debian/patches/CVE-2026-66034.patch\n+++ /dev/null\n@@ -1,31 +0,0 @@\n-From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001\n-From: Viktor Szakats \n-Date: Sat, 4 Jul 2026 11:19:49 +0200\n-Subject: [PATCH] publickey: fix potential OOB read in\n- `libssh2_publickey_list_fetch()`\n-\n-Reported-by: Vladimir Eli Tokarev\n-Fixes GHSA-w6g9-cpfp-22gc\n-\n-Closes #2202\n-Forwarded: not-needed\n----\n- src/publickey.c | 7 +++++++\n- 1 file changed, 7 insertions(+)\n-\n---- a/src/publickey.c\n-+++ b/src/publickey.c\n-@@ -988,6 +988,13 @@\n- }\n- \n- if(comment_len) {\n-+ if(pkey->listFetch_s + comment_len >\n-+ pkey->listFetch_data + pkey->listFetch_data_len) {\n-+ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,\n-+ \"ListFetch data too short\");\n-+ goto err_exit;\n-+ }\n-+\n- list[keys].num_attrs = 1;\n- list[keys].attrs =\n- LIBSSH2_ALLOC(session,\ndiff --git a/debian/patches/CVE-2026-66035.patch b/debian/patches/CVE-2026-66035.patch\ndeleted file mode 100644\nindex 2008ea4..0000000\n--- a/debian/patches/CVE-2026-66035.patch\n+++ /dev/null\n@@ -1,37 +0,0 @@\n-From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001\n-From: Viktor Szakats \n-Date: Fri, 3 Jul 2026 18:22:55 +0200\n-Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt\n-\n-Reported-by: Vladimir Eli Tokarev\n-Fixes GHSA-6c79-444r-wx26\n-\n-Closes #2198\n-Forwarded: not-needed\n----\n- src/transport.c | 7 ++++++-\n- 1 file changed, 6 insertions(+), 1 deletion(-)\n-\n---- a/src/transport.c\n-+++ b/src/transport.c\n-@@ -242,6 +242,12 @@\n- unsigned char *decrypt_buffer;\n- int blocksize = session->remote.crypt->blocksize;\n- \n-+ if(p->total_num < mac_len + 4 + (size_t)blocksize) {\n-+ LIBSSH2_FREE(session, p->payload);\n-+ return LIBSSH2_ERROR_DECRYPT;\n-+ }\n-+ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);\n-+\n- rc = decrypt(session, p->payload + 4,\n- first_block, blocksize, FIRST_BLOCK);\n- if(rc) {\n-@@ -249,7 +255,6 @@\n- }\n- \n- /* we need buffer for decrypt */\n-- decrypt_size = p->total_num - mac_len - 4;\n- decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);\n- if(!decrypt_buffer) {\n- return LIBSSH2_ERROR_ALLOC;\ndiff --git a/debian/patches/cve-2026-7598.patch b/debian/patches/cve-2026-7598.patch\ndeleted file mode 100644\nindex f342861..0000000\n--- a/debian/patches/cve-2026-7598.patch\n+++ /dev/null\n@@ -1,51 +0,0 @@\n-From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001\n-From: Will Cosgrove \n-Date: Mon, 13 Apr 2026 11:18:25 -0700\n-Subject: [PATCH] userauth.c: username_len bounds checking (#1858)\n-Forwarded: https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1\n-\n-Return errors when username_len will exceed bounds, fix existing bounds\n-check.\n-\n-Credit:\n-[dapickle](https://github.com/dapickle)\n----\n- src/userauth.c | 13 ++++++++++++-\n- 1 file changed, 12 insertions(+), 1 deletion(-)\n-\n---- a/src/userauth.c\n-+++ b/src/userauth.c\n-@@ -80,6 +80,12 @@\n- memset(&session->userauth_list_packet_requirev_state, 0,\n- sizeof(session->userauth_list_packet_requirev_state));\n- \n-+ if(username_len > UINT32_MAX - 27) {\n-+ _libssh2_error(session, LIBSSH2_ERROR_PROTO,\n-+ \"username_len out of bounds\");\n-+ return NULL;\n-+ }\n-+\n- session->userauth_list_data_len = username_len + 27;\n- \n- s = session->userauth_list_data =\n-@@ -307,6 +313,11 @@\n- * 40 = packet_type(1) + username_len(4) + service_len(4) +\n- * service(14)\"ssh-connection\" + method_len(4) + method(8)\"password\" +\n- * chgpwdbool(1) + password_len(4) */\n-+ if(username_len > UINT32_MAX - 40) {\n-+ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,\n-+ \"username_len out of bounds\");\n-+ }\n-+\n- session->userauth_pswd_data_len = username_len + 40;\n- \n- session->userauth_pswd_data0 =\n-@@ -447,7 +458,7 @@\n- }\n- \n- /* basic data_len + newpw_len(4) */\n-- if(username_len + password_len + 44 <= UINT_MAX) {\n-+ if(username_len <= UINT32_MAX - password_len - 44) {\n- session->userauth_pswd_data_len =\n- username_len + password_len + 44;\n- s = session->userauth_pswd_data =\ndiff --git a/debian/patches/libssh-unconst-backport.patch b/debian/patches/libssh-unconst-backport.patch\ndeleted file mode 100644\nindex 4d75169..0000000\n--- a/debian/patches/libssh-unconst-backport.patch\n+++ /dev/null\n@@ -1,24 +0,0 @@\n-Needed by the fix for CVE-2025-15661\n-\n-Cherrypicked from \n-commit 606c102e52f8447de2b745dd6c5ddf418defc519\n-Author: Viktor Szakats \n-Date: Thu Jan 30 21:18:23 2025 +0100\n-\n---- libssh2-1.11.1.orig/src/libssh2_priv.h\n-+++ libssh2-1.11.1/src/libssh2_priv.h\n-@@ -117,6 +117,14 @@\n- #define UINT32_MAX 0xffffffffU\n- #endif\n- \n-+#ifdef _WIN64\n-+#define LIBSSH2_UNCONST(p) ((void *)(libssh2_uint64_t)(const void *)(p))\n-+#elif defined(_MSC_VER)\n-+#define LIBSSH2_UNCONST(p) ((void *)(unsigned int)(const void *)(p))\n-+#else\n-+#define LIBSSH2_UNCONST(p) ((void *)(uintptr_t)(const void *)(p))\n-+#endif\n-+\n- #if (defined(__GNUC__) || defined(__clang__)) && \\\n- defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \\\n- !defined(LIBSSH2_NO_FMT_CHECKS)\ndiff --git a/debian/patches/series b/debian/patches/series\nindex aaff6f1..6d3c904 100644\n--- a/debian/patches/series\n+++ b/debian/patches/series\n@@ -6,14 +6,3 @@\n #CVE-2023-48795.patch\n #maxpathlen.patch\n #openssh-9.8.patch\n-cve-2026-7598.patch\n-CVE-2025-15661.patch\n-CVE-2026-55199.patch\n-CVE-2026-55200.patch\n-libssh-unconst-backport.patch\n-CVE-2026-66032.patch\n-CVE-2026-66033.patch\n-CVE-2026-66034.patch\n-CVE-2026-66035.patch\n-CVE-2026-58050.patch\n-CVE-2026-58051.patch\n","remote_name":"master","revision":"git-v1:b38cbc31c61d552fb997706356585cbb112c426a","role":"main"}],"result_code":"success","result_tags":[],"revision":"git-v1:b38cbc31c61d552fb997706356585cbb112c426a","start_time":"2026-11-08T02:14:20.200077Z","subpath":"","suite":"control","target_branch_url":null,"vcs_type":"git","worker":"tyr"},"run_id":"8b6bed3f-75e9-40df-97aa-8455b8c61c38","success_probability":1.0,"suite":"control","total_previous_runs":1,"utcnow":"2026-11-09T03:35:29.332354959+00:00","vcs_type":"git","vcs_url":"git+ssh://git@salsa.debian.org/debian/libssh2.git","version":"0.0.0","worker_log_name":"worker.log","worker_name":"tyr"}