[AutoPR- Security] Patch libssh for CVE-2026-3731 [MEDIUM]#16159
Open
azurelinux-security wants to merge 1 commit intomicrosoft:3.0-devfrom
Open
[AutoPR- Security] Patch libssh for CVE-2026-3731 [MEDIUM]#16159azurelinux-security wants to merge 1 commit intomicrosoft:3.0-devfrom
azurelinux-security wants to merge 1 commit intomicrosoft:3.0-devfrom
Conversation
microsoft-github-policy-service
bot
added
Packaging
3.0-dev
Contributor
Author
🔒 CVE Patch Review: CVE-2026-3731PR #16159 — [AutoPR- Security] Patch libssh for CVE-2026-3731 [MEDIUM] Spec File Validation
Build Verification
🤖 AI Build Log Analysis
🧪 Test Log Analysis
🤖 AI Test Log Analysis
Patch Analysis
Detailed analysis
Conclusion: This is a faithful backport of the upstream fix with only cosmetic differences and packaging adjustments. Raw diff (upstream vs PR)--- upstream
+++ pr
@@ -1,40 +1,48 @@
-From f80670a7aba86cbb442c9b115c9eaf4ca04601b8 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Thu, 11 Dec 2025 13:22:44 +0100
-Subject: sftp: Fix out-of-bound read from sftp extensions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
-Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
-(cherry picked from commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60)
----
- src/sftp.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/sftp.c b/src/sftp.c
-index c9f82912a..d12901230 100644
---- a/src/sftp.c
-+++ b/src/sftp.c
-@@ -587,7 +587,7 @@ const char *sftp_extensions_get_name(sftp_session sftp, unsigned int idx)
- return NULL;
- }
-
-- if (idx > sftp->ext->count) {
-+ if (idx >= sftp->ext->count) {
- ssh_set_error_invalid(sftp->session);
- return NULL;
- }
-@@ -606,7 +606,7 @@ const char *sftp_extensions_get_data(sftp_session sftp, unsigned int idx)
- return NULL;
- }
-
-- if (idx > sftp->ext->count) {
-+ if (idx >= sftp->ext->count) {
- ssh_set_error_invalid(sftp->session);
- return NULL;
- }
---
-cgit v1.2.3
-
+diff --git a/SPECS/libssh/CVE-2026-3731.patch b/SPECS/libssh/CVE-2026-3731.patch
+new file mode 100644
+index 00000000000..cab6f3cb20c
+--- /dev/null
++++ b/SPECS/libssh/CVE-2026-3731.patch
+@@ -0,0 +1,42 @@
++From 7e85a3106d43699b1662d46480b377bfc55fcbbf Mon Sep 17 00:00:00 2001
++From: Jakub Jelen <jjelen@redhat.com>
++Date: Thu, 11 Dec 2025 13:22:44 +0100
++Subject: [PATCH] sftp: Fix out-of-bound read from sftp extensions
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++Signed-off-by: Jakub Jelen <jjelen@redhat.com>
++Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
++(cherry picked from commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60)
++Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
++Upstream-reference: https://git.libssh.org/projects/libssh.git/patch/?id=f80670a7aba86cbb442c9b115c9eaf4ca04601b8
++---
++ src/sftp.c | 4 ++--
++ 1 file changed, 2 insertions(+), 2 deletions(-)
++
++diff --git a/src/sftp.c b/src/sftp.c
++index e01012a..e55f5e1 100644
++--- a/src/sftp.c
+++++ b/src/sftp.c
++@@ -768,7 +768,7 @@ const char *sftp_extensions_get_name(sftp_session sftp, unsigned int idx) {
++ return NULL;
++ }
++
++- if (idx > sftp->ext->count) {
+++ if (idx >= sftp->ext->count) {
++ ssh_set_error_invalid(sftp->session);
++ return NULL;
++ }
++@@ -784,7 +784,7 @@ const char *sftp_extensions_get_data(sftp_session sftp, unsigned int idx) {
++ return NULL;
++ }
++
++- if (idx > sftp->ext->count) {
+++ if (idx >= sftp->ext->count) {
++ ssh_set_error_invalid(sftp->session);
++ return NULL;
++ }
++--
++2.45.4
++
Verdict❌ CHANGES REQUESTED — Please address the issues flagged above. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto Patch libssh for CVE-2026-3731.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1067127&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology