From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Paul Howarth To: git-commits@fedoraproject.org Subject: [rpms/libssh2] f43: Address CVE-2025-15661 Date: Thu, 25 Jun 2026 14:14:25 GMT Message-ID: <178239686519.1.6182699392845513392.rpms-libssh2-13fb9aee68b7@fedoraproject.org> List-ID: X-Git-Repo: rpms/libssh2 X-Git-Branch: f43 X-Git-Rev: 13fb9aee68b781a29ad5ae4e7a825a0eab20c355 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvbGlic3NoMgogICAgICAgICAgICBCcmFuY2ggOiBmNDMKICAgICAgICAgICAg Q29tbWl0IDogMTNmYjlhZWU2OGI3ODFhMjlhZDVhZTRlN2E4MjVhMGVhYjIwYzM1NQogICAgICAg ICAgICBBdXRob3IgOiBQYXVsIEhvd2FydGggPHBhdWxAY2l0eS1mYW4ub3JnPgogICAgICAgICAg ICBEYXRlICAgOiAyMDI2LTA2LTI1VDEzOjA5OjUwKzAxOjAwCiAgICAgICAgICAgIFN0YXRzICA6 ICsxNTEvLTEgaW4gMiBmaWxlKHMpCiAgICAgICAgICAgIFVSTCAgICA6IGh0dHBzOi8vc3JjLmZl ZG9yYXByb2plY3Qub3JnL3JwbXMvbGlic3NoMi9jLzEzZmI5YWVlNjhiNzgxYTI5YWQ1YWU0ZTdh ODI1YTBlYWIyMGMzNTU/YnJhbmNoPWY0MwoKICAgICAgICAgICAgTG9nOgogICAgICAgICAgICBB ZGRyZXNzIENWRS0yMDI1LTE1NjYxCgpJbmZvcm1hdGlvbiBkaXNjbG9zdXJlIGFuZCBkZW5pYWwg b2Ygc2VydmljZSB2aWEgY3JhZnRlZCBTRlRQIHJlc3BvbnNlCi0gaHR0cHM6Ly9naXRodWIuY29t L2xpYnNzaDIvbGlic3NoMi9wdWxsLzE3MDUKLSBodHRwczovL2dpdGh1Yi5jb20vbGlic3NoMi9s aWJzc2gyL3B1bGwvMTcxNwoKLS0tCmRpZmYgLS1naXQgYS8yZGFlMzAyLWxpYnNzaDItMS4xMS4x LnBhdGNoIGIvMmRhZTMwMi1saWJzc2gyLTEuMTEuMS5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwLi43YmEwNzc0Ci0tLSAvZGV2L251bGwKKysrIGIvMmRhZTMwMi1saWJz c2gyLTEuMTEuMS5wYXRjaApAQCAtMCwwICsxLDEzOCBAQAorRnJvbSAyZGFlMzAyNDg5N2UxODk4 ZDM4OTgzNTE1MWY0ZTk2MDYyMjc3MjFkIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTog V2lsbCBDb3Nncm92ZSA8d2lsbEBwYW5pYy5jb20+CitEYXRlOiBGcmksIDEwIE9jdCAyMDI1IDA4 OjI2OjIwIC0wNzAwCitTdWJqZWN0OiBbUEFUQ0hdIFVwZGF0ZSBzZnRwX3N5bWxpbmsgdG8gYXZv aWQgb3V0IG9mIGJvdW5kcyByZWFkIG9uIG1hbGZvcm1lZAorIHBhY2tldCAjMTcwNSAoIzE3MTcp CisKK1VzZSBidWZmZXIgc3RydWN0IHRvIGd1YXJkIGFnYWluc3Qgb3V0IG9mIGJvdW5kcyByZWFk cyBhbmQgaW52YWxpZCBwYWNrZXRzLgorCitEaXNjb3ZlcnkgQ3JlZGl0OgorSm9zaHVhIFJvZ2Vy cworLS0tCisgc3JjL3NmdHAuYyB8IDY2ICsrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysr KysrKysrLS0tLS0tLS0tLS0tLS0tLQorIDEgZmlsZSBjaGFuZ2VkLCA0NyBpbnNlcnRpb25zKCsp LCAxOSBkZWxldGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL3NyYy9zZnRwLmMgYi9zcmMvc2Z0cC5j CitpbmRleCA3MmIwMDdmNmViLi43MGQ3Njg2ZGFmIDEwMDY0NAorLS0tIGEvc3JjL3NmdHAuYwor KysrIGIvc3JjL3NmdHAuYworQEAgLTM3OTUsMTUgKzM3OTUsMTkgQEAgc3RhdGljIGludCBzZnRw X3N5bWxpbmsoTElCU1NIMl9TRlRQICpzZnRwLCBjb25zdCBjaGFyICpwYXRoLAorIHsKKyAgICAg TElCU1NIMl9DSEFOTkVMICpjaGFubmVsID0gc2Z0cC0+Y2hhbm5lbDsKKyAgICAgTElCU1NIMl9T RVNTSU9OICpzZXNzaW9uID0gY2hhbm5lbC0+c2Vzc2lvbjsKKy0gICAgc2l6ZV90IGRhdGFfbGVu ID0gMCwgbGlua19sZW47CisrICAgIHNpemVfdCBkYXRhX2xlbiA9IDAsIGxrX2xlbjsKKyAgICAg LyogMTMgPSBwYWNrZXRfbGVuKDQpICsgcGFja2V0X3R5cGUoMSkgKyByZXF1ZXN0X2lkKDQpICsg cGF0aF9sZW4oNCkgKi8KKyAgICAgc3NpemVfdCBwYWNrZXRfbGVuID0KKyAgICAgICAgIHBhdGhf bGVuICsgMTMgKworICAgICAgICAgKChsaW5rX3R5cGUgPT0gTElCU1NIMl9TRlRQX1NZTUxJTksp ID8gKDQgKyB0YXJnZXRfbGVuKSA6IDApOworICAgICB1bnNpZ25lZCBjaGFyICpzLCAqZGF0YSA9 IE5VTEw7CisrICAgIHN0cnVjdCBzdHJpbmdfYnVmIGJ1ZjsKKyAgICAgc3RhdGljIGNvbnN0IHVu c2lnbmVkIGNoYXIgbGlua19yZXNwb25zZXNbMl0gPQorICAgICAgICAgeyBTU0hfRlhQX05BTUUs IFNTSF9GWFBfU1RBVFVTIH07CisgICAgIGludCByZXRjb2RlOworKyAgICB1bnNpZ25lZCBjaGFy IHBhY2tldF90eXBlOworKyAgICB1aW50MzJfdCB0bXBfdTMyOworKyAgICB1bnNpZ25lZCBjaGFy ICpsa190YXJnZXQ7CisgCisgICAgIGlmKHNmdHAtPnN5bWxpbmtfc3RhdGUgPT0gbGlic3NoMl9O Ql9zdGF0ZV9pZGxlKSB7CisgICAgICAgICBzZnRwLT5sYXN0X2Vycm5vID0gTElCU1NIMl9GWF9P SzsKK0BAIC0zODkxLDggKzM4OTUsMjUgQEAgc3RhdGljIGludCBzZnRwX3N5bWxpbmsoTElCU1NI Ml9TRlRQICpzZnRwLCBjb25zdCBjaGFyICpwYXRoLAorIAorICAgICBzZnRwLT5zeW1saW5rX3N0 YXRlID0gbGlic3NoMl9OQl9zdGF0ZV9pZGxlOworIAorLSAgICBpZihkYXRhWzBdID09IFNTSF9G WFBfU1RBVFVTKSB7CistICAgICAgICByZXRjb2RlID0gX2xpYnNzaDJfbnRvaHUzMihkYXRhICsg NSk7CisrICAgIGJ1Zi5kYXRhID0gKHVuc2lnbmVkIGNoYXIgKilTU0gyX1VOQ09OU1QoZGF0YSk7 CisrICAgIGJ1Zi5kYXRhcHRyID0gYnVmLmRhdGE7CisrICAgIGJ1Zi5sZW4gPSBkYXRhX2xlbjsK KysKKysgICAgaWYoX2xpYnNzaDJfZ2V0X2J5dGUoJmJ1ZiwgJnBhY2tldF90eXBlKSkgeworKyAg ICAgICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOworKyAgICAgICAgcmV0dXJuIF9saWJz c2gyX2Vycm9yKHNlc3Npb24sIExJQlNTSDJfRVJST1JfU0ZUUF9QUk9UT0NPTCwKKysgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAiU0ZUUCBQcm90b2NvbCBFcnJvciAodHlwZSkiKTsKKysg ICAgfQorKworKyAgICBpZihwYWNrZXRfdHlwZSA9PSBTU0hfRlhQX1NUQVRVUykgeworKyAgICAg ICAgaWYoX2xpYnNzaDJfZ2V0X3UzMigmYnVmLCAmdG1wX3UzMikpIHsKKysgICAgICAgICAgICBM SUJTU0gyX0ZSRUUoc2Vzc2lvbiwgZGF0YSk7CisrICAgICAgICAgICAgcmV0dXJuIF9saWJzc2gy X2Vycm9yKHNlc3Npb24sIExJQlNTSDJfRVJST1JfU0ZUUF9QUk9UT0NPTCwKKysgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgUHJvdG9jb2wgRXJyb3IgKGNvZGUpIik7Cisr ICAgICAgICB9CisrCisrICAgICAgICByZXRjb2RlID0gKGludCl0bXBfdTMyOworKworICAgICAg ICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOworICAgICAgICAgaWYocmV0Y29kZSA9PSBM SUJTU0gyX0ZYX09LKQorICAgICAgICAgICAgIHJldHVybiBMSUJTU0gyX0VSUk9SX05PTkU7CitA QCAtMzkwMywzMCArMzkyNCwzNyBAQCBzdGF0aWMgaW50IHNmdHBfc3ltbGluayhMSUJTU0gyX1NG VFAgKnNmdHAsIGNvbnN0IGNoYXIgKnBhdGgsCisgICAgICAgICB9CisgICAgIH0KKyAKKy0gICAg aWYoX2xpYnNzaDJfbnRvaHUzMihkYXRhICsgNSkgPCAxKSB7CisrICAgIC8qIGFkdmFuY2UgcGFz dCBpZCAqLworKyAgICBpZihfbGlic3NoMl9nZXRfdTMyKCZidWYsICZ0bXBfdTMyKSkgeworICAg ICAgICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOworICAgICAgICAgcmV0dXJuIF9saWJz c2gyX2Vycm9yKHNlc3Npb24sIExJQlNTSDJfRVJST1JfU0ZUUF9QUk9UT0NPTCwKKy0gICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAiSW52YWxpZCBSRUFETElOSy9SRUFMUEFUSCByZXNwb25z ZSwgIgorLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJubyBuYW1lIGVudHJpZXMiKTsK KysgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiU0ZUUCBQcm90b2NvbCBFcnJvciAoaWQp Iik7CisgICAgIH0KKyAKKy0gICAgaWYoZGF0YV9sZW4gPCAxMykgeworLSAgICAgICAgaWYoZGF0 YV9sZW4gPiAwKSB7CistICAgICAgICAgICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOwor LSAgICAgICAgfQorKyAgICAvKiBsb29rIGZvciBhdCBsZWFzdCBvbmUgbGluayAqLworKyAgICBp ZihfbGlic3NoMl9nZXRfdTMyKCZidWYsICZ0bXBfdTMyKSB8fCB0bXBfdTMyIDwgMSkgeworKyAg ICAgICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOworICAgICAgICAgcmV0dXJuIF9saWJz c2gyX2Vycm9yKHNlc3Npb24sIExJQlNTSDJfRVJST1JfU0ZUUF9QUk9UT0NPTCwKKy0gICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAiU0ZUUCBzdGF0IHBhY2tldCB0b28gc2hvcnQiKTsKKysg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkludmFsaWQgUkVBRExJTksvUkVB TFBBVEggcmVzcG9uc2UsICIKKysgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg Im5vIG5hbWUgZW50cmllcyIpOworICAgICB9CisgCistICAgIC8qIHRoaXMgcmVhZHMgYSB1MzIg YW5kIHN0b3JlcyBpdCBpbnRvIGEgc2lnbmVkIDMyYml0IHZhbHVlICovCistICAgIGxpbmtfbGVu ID0gX2xpYnNzaDJfbnRvaHUzMihkYXRhICsgOSk7CistICAgIGlmKGxpbmtfbGVuIDwgdGFyZ2V0 X2xlbikgeworLSAgICAgICAgbWVtY3B5KHRhcmdldCwgZGF0YSArIDEzLCBsaW5rX2xlbik7Cist ICAgICAgICB0YXJnZXRbbGlua19sZW5dID0gMDsKKy0gICAgICAgIHJldGNvZGUgPSAoaW50KWxp bmtfbGVuOworKyAgICBpZihfbGlic3NoMl9nZXRfc3RyaW5nKCZidWYsICZsa190YXJnZXQsICZs a19sZW4pID09IExJQlNTSDJfRVJST1JfTk9ORSkgeworKyAgICAgICAgaWYobGtfbGVuIDwgdGFy Z2V0X2xlbikgeworKyAgICAgICAgICAgIG1lbWNweSh0YXJnZXQsIGxrX3RhcmdldCwgbGtfbGVu KTsKKysgICAgICAgICAgICB0YXJnZXRbbGtfbGVuXSA9ICdcMCc7CisrICAgICAgICAgICAgcmV0 Y29kZSA9IChpbnQpbGtfbGVuOworKyAgICAgICAgfQorKyAgICAgICAgZWxzZSB7CisrICAgICAg ICAgICAgcmV0Y29kZSA9IExJQlNTSDJfRVJST1JfQlVGRkVSX1RPT19TTUFMTDsKKysgICAgICAg IH0KKyAgICAgfQorLSAgICBlbHNlCistICAgICAgICByZXRjb2RlID0gTElCU1NIMl9FUlJPUl9C VUZGRVJfVE9PX1NNQUxMOworKyAgICBlbHNlIHsKKysgICAgICAgIExJQlNTSDJfRlJFRShzZXNz aW9uLCBkYXRhKTsKKysgICAgICAgIHJldHVybiBfbGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJT U0gyX0VSUk9SX1NGVFBfUFJPVE9DT0wsCisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IlNGVFAgUHJvdG9jb2wgRXJyb3IgKGZpbGVuYW1lKSIpOworKyAgICB9CisrCisgICAgIExJQlNT SDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAKKyAgICAgcmV0dXJuIHJldGNvZGU7CistLS0gYS9z cmMvbGlic3NoMl9wcml2LmgKKysrKyBiL3NyYy9saWJzc2gyX3ByaXYuaAorQEAgLTExNyw2ICsx MTcsMTQgQEAKKyAjZGVmaW5lIFVJTlQzMl9NQVggMHhmZmZmZmZmZlUKKyAjZW5kaWYKKyAKKysj aWZkZWYgX1dJTjY0CisrI2RlZmluZSBTU0gyX1VOQ09OU1QocCkgICgodm9pZCAqKShsaWJzc2gy X3VpbnQ2NF90KShjb25zdCB2b2lkICopKHApKQorKyNlbGlmIGRlZmluZWQoX01TQ19WRVIpCisr I2RlZmluZSBTU0gyX1VOQ09OU1QocCkgICgodm9pZCAqKSh1bnNpZ25lZCBpbnQpKGNvbnN0IHZv aWQgKikocCkpCisrI2Vsc2UKKysjZGVmaW5lIFNTSDJfVU5DT05TVChwKSAgKCh2b2lkICopKHVp bnRwdHJfdCkoY29uc3Qgdm9pZCAqKShwKSkKKysjZW5kaWYKKysKKyAjaWYgKGRlZmluZWQoX19H TlVDX18pIHx8IGRlZmluZWQoX19jbGFuZ19fKSkgJiYgXAorICAgICBkZWZpbmVkKF9fU1REQ19W RVJTSU9OX18pICYmIChfX1NURENfVkVSU0lPTl9fID49IDE5OTkwMUwpICYmIFwKKyAgICAgIWRl ZmluZWQoTElCU1NIMl9OT19GTVRfQ0hFQ0tTKQoKZGlmZiAtLWdpdCBhL2xpYnNzaDIuc3BlYyBi L2xpYnNzaDIuc3BlYwppbmRleCBkYzJmY2Y2Li43MGFiNjk3IDEwMDY0NAotLS0gYS9saWJzc2gy LnNwZWMKKysrIGIvbGlic3NoMi5zcGVjCkBAIC02LDcgKzYsNyBAQAogCiBOYW1lOgkJbGlic3No MgogVmVyc2lvbjoJMS4xMS4xCi1SZWxlYXNlOgk4JXs/ZGlzdH0KK1JlbGVhc2U6CTklez9kaXN0 fQogU3VtbWFyeToJQSBsaWJyYXJ5IGltcGxlbWVudGluZyB0aGUgU1NIMiBwcm90b2NvbAogTGlj ZW5zZToJQlNELTMtQ2xhdXNlCiBVUkw6CQlodHRwczovL3d3dy5saWJzc2gyLm9yZy8KQEAgLTE3 LDYgKzE3LDcgQEAgU291cmNlMjoJaHR0cHM6Ly9kYW5pZWwuaGF4eC5zZS9teWtleS5hc2MKIFBh dGNoMDoJCWxpYnNzaDItMS4xMS4xLUNWRS0yMDI2LTc1OTgucGF0Y2gKIFBhdGNoMToJCTk3YWNm M2RmZGE4MGM5MWMzYThjOWYyMzcyNTQ2MzAxZDRhMWE3YTgtbGlic3NoMi0xLjExLjEucGF0Y2gK IFBhdGNoMjoJCTE3NjI2ODU3ZDIwYjNjOWExYWRkZmE0NTk3OWRhZGNlZTFjZDg0YTQucGF0Y2gK K1BhdGNoMzoJCTJkYWUzMDItbGlic3NoMi0xLjExLjEucGF0Y2gKIAogQnVpbGRSZXF1aXJlczoJ Y29yZXV0aWxzCiBCdWlsZFJlcXVpcmVzOglmaW5kdXRpbHMKQEAgLTY4LDE0ICs2OSwyMSBAQCBk ZXZlbG9waW5nIGFwcGxpY2F0aW9ucyB0aGF0IHVzZSBsaWJzc2gyLgogIyBDVkUtMjAyNi03NTk4 IGxpYnNzaDI6IGludGVnZXIgb3ZlcmZsb3cgdmlhIGxhcmdlIHVzZXJuYW1lIG9yIHBhc3N3b3Jk IGFyZ3VtZW50cwogIyBodHRwczovL2dpdGh1Yi5jb20vbGlic3NoMi9saWJzc2gyL3B1bGwvMTg1 OAogJXBhdGNoIC1QMAorCiAjIENWRS0yMDI2LTU1MjAwIHRyYW5zcG9ydC5jOiBBZGRpdGlvbmFs IGJvdW5kYXJ5IGNoZWNrcyBmb3IgcGFja2V0IGxlbmd0aAogIyBQYXRjaCBtb2RpZmllZCBmb3Ig ZG93bnN0cmVhbQogIyBodHRwczovL2dpdGh1Yi5jb20vbGlic3NoMi9saWJzc2gyL3B1bGwvMjA1 MgogJXBhdGNoIC1wMSAtUDEKKwogIyBDVkUtMjAyNi01NTE5OSBwYWNrZXQuYzogY2hlY2sgX2xp YnNzaDJfZ2V0X3N0cmluZygpIHJldHVybiBpbiBFWFRfSU5GTyBoYW5kbGVyCiAjIGh0dHBzOi8v Z2l0aHViLmNvbS9saWJzc2gyL2xpYnNzaDIvcHVsbC8xODY0CiAlcGF0Y2ggLXAxIC1QMgogCisj IENWRS0yMDI1LTE1NjYxOiBJbmZvcm1hdGlvbiBkaXNjbG9zdXJlIGFuZCBkZW5pYWwgb2Ygc2Vy dmljZSB2aWEgY3JhZnRlZCBTRlRQIHJlc3BvbnNlCisjIGh0dHBzOi8vZ2l0aHViLmNvbS9saWJz c2gyL2xpYnNzaDIvcHVsbC8xNzA1CisjIGh0dHBzOi8vZ2l0aHViLmNvbS9saWJzc2gyL2xpYnNz aDIvcHVsbC8xNzE3CislcGF0Y2ggLXAxIC1QMworCiAjIFJlcGxhY2UgaGFyZCB3aXJlZCBwb3J0 IG51bWJlciBpbiB0aGUgdGVzdCBzdWl0ZSB0byBhdm9pZCBjb2xsaXNpb25zCiAjIGJldHdlZW4g MzItYml0IGFuZCA2NC1iaXQgYnVpbGRzIHJ1bm5pbmcgb24gYSBzaW5nbGUgYnVpbGQtaG9zdAog c2VkIC1pIHMvNDcxMS80NyV7P19faXNhX2JpdHN9LyB0ZXN0cy97b3BlbnNzaF9maXh0dXJlLmMs dGVzdF9zc2h7Mi5jLGQudGVzdH19CkBAIC0xMzAsNiArMTM4LDEwIEBAIExDX0FMTD1lbl9VUy5V VEYtOCBtYWtlIC1DIHRlc3RzIGNoZWNrCiAle19saWJkaXJ9L3BrZ2NvbmZpZy9saWJzc2gyLnBj CiAKICVjaGFuZ2Vsb2cKKyogVGh1IEp1biAyNSAyMDI2IFBhdWwgSG93YXJ0aCA8cGF1bEBjaXR5 LWZhbi5vcmc+IC0gMS4xMS4xLTkKKy0gRml4IENWRS0yMDI1LTE1NjYxOiBJbmZvcm1hdGlvbiBk aXNjbG9zdXJlIGFuZCBkZW5pYWwgb2Ygc2VydmljZSB2aWEgY3JhZnRlZAorICBTRlRQIHJlc3Bv bnNlCisKICogVHVlIEp1biAyMyAyMDI2IE1pa2VsIE9sYXNhZ2FzdGkgVXJhbmdhIDxtaWtlbEBv bGFzYWdhc3RpLmluZm8+IC0gMS4xMS4xLTgKIC0gRml4IENWRS0yMDI2LTU1MjAwICYgQ1ZFLTIw MjYtNTUxOTkKIAo=