From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Paul Howarth To: git-commits@fedoraproject.org Subject: [rpms/libssh2] epel10.2: Address CVE-2025-15661 Date: Thu, 25 Jun 2026 14:35:29 GMT Message-ID: <178239812956.1.8196660538058875635.rpms-libssh2-13fb9aee68b7@fedoraproject.org> List-ID: X-Git-Repo: rpms/libssh2 X-Git-Branch: epel10.2 X-Git-Rev: 13fb9aee68b781a29ad5ae4e7a825a0eab20c355 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvbGlic3NoMgogICAgICAgICAgICBCcmFuY2ggOiBlcGVsMTAuMgogICAgICAg ICAgICBDb21taXQgOiAxM2ZiOWFlZTY4Yjc4MWEyOWFkNWFlNGU3YTgyNWEwZWFiMjBjMzU1CiAg ICAgICAgICAgIEF1dGhvciA6IFBhdWwgSG93YXJ0aCA8cGF1bEBjaXR5LWZhbi5vcmc+CiAgICAg ICAgICAgIERhdGUgICA6IDIwMjYtMDYtMjVUMTM6MDk6NTArMDE6MDAKICAgICAgICAgICAgU3Rh dHMgIDogKzE1MS8tMSBpbiAyIGZpbGUocykKICAgICAgICAgICAgVVJMICAgIDogaHR0cHM6Ly9z cmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9saWJzc2gyL2MvMTNmYjlhZWU2OGI3ODFhMjlhZDVh ZTRlN2E4MjVhMGVhYjIwYzM1NT9icmFuY2g9ZXBlbDEwLjIKCiAgICAgICAgICAgIExvZzoKICAg ICAgICAgICAgQWRkcmVzcyBDVkUtMjAyNS0xNTY2MQoKSW5mb3JtYXRpb24gZGlzY2xvc3VyZSBh bmQgZGVuaWFsIG9mIHNlcnZpY2UgdmlhIGNyYWZ0ZWQgU0ZUUCByZXNwb25zZQotIGh0dHBzOi8v Z2l0aHViLmNvbS9saWJzc2gyL2xpYnNzaDIvcHVsbC8xNzA1Ci0gaHR0cHM6Ly9naXRodWIuY29t L2xpYnNzaDIvbGlic3NoMi9wdWxsLzE3MTcKCi0tLQpkaWZmIC0tZ2l0IGEvMmRhZTMwMi1saWJz c2gyLTEuMTEuMS5wYXRjaCBiLzJkYWUzMDItbGlic3NoMi0xLjExLjEucGF0Y2gKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uN2JhMDc3NAotLS0gL2Rldi9udWxsCisrKyBiLzJk YWUzMDItbGlic3NoMi0xLjExLjEucGF0Y2gKQEAgLTAsMCArMSwxMzggQEAKK0Zyb20gMmRhZTMw MjQ4OTdlMTg5OGQzODk4MzUxNTFmNGU5NjA2MjI3NzIxZCBNb24gU2VwIDE3IDAwOjAwOjAwIDIw MDEKK0Zyb206IFdpbGwgQ29zZ3JvdmUgPHdpbGxAcGFuaWMuY29tPgorRGF0ZTogRnJpLCAxMCBP Y3QgMjAyNSAwODoyNjoyMCAtMDcwMAorU3ViamVjdDogW1BBVENIXSBVcGRhdGUgc2Z0cF9zeW1s aW5rIHRvIGF2b2lkIG91dCBvZiBib3VuZHMgcmVhZCBvbiBtYWxmb3JtZWQKKyBwYWNrZXQgIzE3 MDUgKCMxNzE3KQorCitVc2UgYnVmZmVyIHN0cnVjdCB0byBndWFyZCBhZ2FpbnN0IG91dCBvZiBi b3VuZHMgcmVhZHMgYW5kIGludmFsaWQgcGFja2V0cy4KKworRGlzY292ZXJ5IENyZWRpdDoKK0pv c2h1YSBSb2dlcnMKKy0tLQorIHNyYy9zZnRwLmMgfCA2NiArKysrKysrKysrKysrKysrKysrKysr KysrKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0tLS0KKyAxIGZpbGUgY2hhbmdlZCwgNDcgaW5z ZXJ0aW9ucygrKSwgMTkgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1naXQgYS9zcmMvc2Z0cC5jIGIv c3JjL3NmdHAuYworaW5kZXggNzJiMDA3ZjZlYi4uNzBkNzY4NmRhZiAxMDA2NDQKKy0tLSBhL3Ny Yy9zZnRwLmMKKysrKyBiL3NyYy9zZnRwLmMKK0BAIC0zNzk1LDE1ICszNzk1LDE5IEBAIHN0YXRp YyBpbnQgc2Z0cF9zeW1saW5rKExJQlNTSDJfU0ZUUCAqc2Z0cCwgY29uc3QgY2hhciAqcGF0aCwK KyB7CisgICAgIExJQlNTSDJfQ0hBTk5FTCAqY2hhbm5lbCA9IHNmdHAtPmNoYW5uZWw7CisgICAg IExJQlNTSDJfU0VTU0lPTiAqc2Vzc2lvbiA9IGNoYW5uZWwtPnNlc3Npb247CistICAgIHNpemVf dCBkYXRhX2xlbiA9IDAsIGxpbmtfbGVuOworKyAgICBzaXplX3QgZGF0YV9sZW4gPSAwLCBsa19s ZW47CisgICAgIC8qIDEzID0gcGFja2V0X2xlbig0KSArIHBhY2tldF90eXBlKDEpICsgcmVxdWVz dF9pZCg0KSArIHBhdGhfbGVuKDQpICovCisgICAgIHNzaXplX3QgcGFja2V0X2xlbiA9CisgICAg ICAgICBwYXRoX2xlbiArIDEzICsKKyAgICAgICAgICgobGlua190eXBlID09IExJQlNTSDJfU0ZU UF9TWU1MSU5LKSA/ICg0ICsgdGFyZ2V0X2xlbikgOiAwKTsKKyAgICAgdW5zaWduZWQgY2hhciAq cywgKmRhdGEgPSBOVUxMOworKyAgICBzdHJ1Y3Qgc3RyaW5nX2J1ZiBidWY7CisgICAgIHN0YXRp YyBjb25zdCB1bnNpZ25lZCBjaGFyIGxpbmtfcmVzcG9uc2VzWzJdID0KKyAgICAgICAgIHsgU1NI X0ZYUF9OQU1FLCBTU0hfRlhQX1NUQVRVUyB9OworICAgICBpbnQgcmV0Y29kZTsKKysgICAgdW5z aWduZWQgY2hhciBwYWNrZXRfdHlwZTsKKysgICAgdWludDMyX3QgdG1wX3UzMjsKKysgICAgdW5z aWduZWQgY2hhciAqbGtfdGFyZ2V0OworIAorICAgICBpZihzZnRwLT5zeW1saW5rX3N0YXRlID09 IGxpYnNzaDJfTkJfc3RhdGVfaWRsZSkgeworICAgICAgICAgc2Z0cC0+bGFzdF9lcnJubyA9IExJ QlNTSDJfRlhfT0s7CitAQCAtMzg5MSw4ICszODk1LDI1IEBAIHN0YXRpYyBpbnQgc2Z0cF9zeW1s aW5rKExJQlNTSDJfU0ZUUCAqc2Z0cCwgY29uc3QgY2hhciAqcGF0aCwKKyAKKyAgICAgc2Z0cC0+ c3ltbGlua19zdGF0ZSA9IGxpYnNzaDJfTkJfc3RhdGVfaWRsZTsKKyAKKy0gICAgaWYoZGF0YVsw XSA9PSBTU0hfRlhQX1NUQVRVUykgeworLSAgICAgICAgcmV0Y29kZSA9IF9saWJzc2gyX250b2h1 MzIoZGF0YSArIDUpOworKyAgICBidWYuZGF0YSA9ICh1bnNpZ25lZCBjaGFyICopU1NIMl9VTkNP TlNUKGRhdGEpOworKyAgICBidWYuZGF0YXB0ciA9IGJ1Zi5kYXRhOworKyAgICBidWYubGVuID0g ZGF0YV9sZW47CisrCisrICAgIGlmKF9saWJzc2gyX2dldF9ieXRlKCZidWYsICZwYWNrZXRfdHlw ZSkpIHsKKysgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKysgICAgICAgIHJl dHVybiBfbGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0ws CisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgUHJvdG9jb2wgRXJyb3IgKHR5 cGUpIik7CisrICAgIH0KKysKKysgICAgaWYocGFja2V0X3R5cGUgPT0gU1NIX0ZYUF9TVEFUVVMp IHsKKysgICAgICAgIGlmKF9saWJzc2gyX2dldF91MzIoJmJ1ZiwgJnRtcF91MzIpKSB7CisrICAg ICAgICAgICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOworKyAgICAgICAgICAgIHJldHVy biBfbGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0wsCisr ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJTRlRQIFByb3RvY29sIEVycm9yIChj b2RlKSIpOworKyAgICAgICAgfQorKworKyAgICAgICAgcmV0Y29kZSA9IChpbnQpdG1wX3UzMjsK KysKKyAgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAgICAgICAgIGlmKHJl dGNvZGUgPT0gTElCU1NIMl9GWF9PSykKKyAgICAgICAgICAgICByZXR1cm4gTElCU1NIMl9FUlJP Ul9OT05FOworQEAgLTM5MDMsMzAgKzM5MjQsMzcgQEAgc3RhdGljIGludCBzZnRwX3N5bWxpbmso TElCU1NIMl9TRlRQICpzZnRwLCBjb25zdCBjaGFyICpwYXRoLAorICAgICAgICAgfQorICAgICB9 CisgCistICAgIGlmKF9saWJzc2gyX250b2h1MzIoZGF0YSArIDUpIDwgMSkgeworKyAgICAvKiBh ZHZhbmNlIHBhc3QgaWQgKi8KKysgICAgaWYoX2xpYnNzaDJfZ2V0X3UzMigmYnVmLCAmdG1wX3Uz MikpIHsKKyAgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAgICAgICAgIHJl dHVybiBfbGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0ws CistICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkludmFsaWQgUkVBRExJTksvUkVBTFBB VEggcmVzcG9uc2UsICIKKy0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAibm8gbmFtZSBl bnRyaWVzIik7CisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgUHJvdG9jb2wg RXJyb3IgKGlkKSIpOworICAgICB9CisgCistICAgIGlmKGRhdGFfbGVuIDwgMTMpIHsKKy0gICAg ICAgIGlmKGRhdGFfbGVuID4gMCkgeworLSAgICAgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9u LCBkYXRhKTsKKy0gICAgICAgIH0KKysgICAgLyogbG9vayBmb3IgYXQgbGVhc3Qgb25lIGxpbmsg Ki8KKysgICAgaWYoX2xpYnNzaDJfZ2V0X3UzMigmYnVmLCAmdG1wX3UzMikgfHwgdG1wX3UzMiA8 IDEpIHsKKysgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAgICAgICAgIHJl dHVybiBfbGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0ws CistICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgc3RhdCBwYWNrZXQgdG9vIHNo b3J0Iik7CisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJJbnZhbGlkIFJF QURMSU5LL1JFQUxQQVRIIHJlc3BvbnNlLCAiCisrICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICJubyBuYW1lIGVudHJpZXMiKTsKKyAgICAgfQorIAorLSAgICAvKiB0aGlzIHJl YWRzIGEgdTMyIGFuZCBzdG9yZXMgaXQgaW50byBhIHNpZ25lZCAzMmJpdCB2YWx1ZSAqLworLSAg ICBsaW5rX2xlbiA9IF9saWJzc2gyX250b2h1MzIoZGF0YSArIDkpOworLSAgICBpZihsaW5rX2xl biA8IHRhcmdldF9sZW4pIHsKKy0gICAgICAgIG1lbWNweSh0YXJnZXQsIGRhdGEgKyAxMywgbGlu a19sZW4pOworLSAgICAgICAgdGFyZ2V0W2xpbmtfbGVuXSA9IDA7CistICAgICAgICByZXRjb2Rl ID0gKGludClsaW5rX2xlbjsKKysgICAgaWYoX2xpYnNzaDJfZ2V0X3N0cmluZygmYnVmLCAmbGtf dGFyZ2V0LCAmbGtfbGVuKSA9PSBMSUJTU0gyX0VSUk9SX05PTkUpIHsKKysgICAgICAgIGlmKGxr X2xlbiA8IHRhcmdldF9sZW4pIHsKKysgICAgICAgICAgICBtZW1jcHkodGFyZ2V0LCBsa190YXJn ZXQsIGxrX2xlbik7CisrICAgICAgICAgICAgdGFyZ2V0W2xrX2xlbl0gPSAnXDAnOworKyAgICAg ICAgICAgIHJldGNvZGUgPSAoaW50KWxrX2xlbjsKKysgICAgICAgIH0KKysgICAgICAgIGVsc2Ug eworKyAgICAgICAgICAgIHJldGNvZGUgPSBMSUJTU0gyX0VSUk9SX0JVRkZFUl9UT09fU01BTEw7 CisrICAgICAgICB9CisgICAgIH0KKy0gICAgZWxzZQorLSAgICAgICAgcmV0Y29kZSA9IExJQlNT SDJfRVJST1JfQlVGRkVSX1RPT19TTUFMTDsKKysgICAgZWxzZSB7CisrICAgICAgICBMSUJTU0gy X0ZSRUUoc2Vzc2lvbiwgZGF0YSk7CisrICAgICAgICByZXR1cm4gX2xpYnNzaDJfZXJyb3Ioc2Vz c2lvbiwgTElCU1NIMl9FUlJPUl9TRlRQX1BST1RPQ09MLAorKyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICJTRlRQIFByb3RvY29sIEVycm9yIChmaWxlbmFtZSkiKTsKKysgICAgfQorKwor ICAgICBMSUJTU0gyX0ZSRUUoc2Vzc2lvbiwgZGF0YSk7CisgCisgICAgIHJldHVybiByZXRjb2Rl OworLS0tIGEvc3JjL2xpYnNzaDJfcHJpdi5oCisrKysgYi9zcmMvbGlic3NoMl9wcml2LmgKK0BA IC0xMTcsNiArMTE3LDE0IEBACisgI2RlZmluZSBVSU5UMzJfTUFYIDB4ZmZmZmZmZmZVCisgI2Vu ZGlmCisgCisrI2lmZGVmIF9XSU42NAorKyNkZWZpbmUgU1NIMl9VTkNPTlNUKHApICAoKHZvaWQg KikobGlic3NoMl91aW50NjRfdCkoY29uc3Qgdm9pZCAqKShwKSkKKysjZWxpZiBkZWZpbmVkKF9N U0NfVkVSKQorKyNkZWZpbmUgU1NIMl9VTkNPTlNUKHApICAoKHZvaWQgKikodW5zaWduZWQgaW50 KShjb25zdCB2b2lkICopKHApKQorKyNlbHNlCisrI2RlZmluZSBTU0gyX1VOQ09OU1QocCkgICgo dm9pZCAqKSh1aW50cHRyX3QpKGNvbnN0IHZvaWQgKikocCkpCisrI2VuZGlmCisrCisgI2lmIChk ZWZpbmVkKF9fR05VQ19fKSB8fCBkZWZpbmVkKF9fY2xhbmdfXykpICYmIFwKKyAgICAgZGVmaW5l ZChfX1NURENfVkVSU0lPTl9fKSAmJiAoX19TVERDX1ZFUlNJT05fXyA+PSAxOTk5MDFMKSAmJiBc CisgICAgICFkZWZpbmVkKExJQlNTSDJfTk9fRk1UX0NIRUNLUykKCmRpZmYgLS1naXQgYS9saWJz c2gyLnNwZWMgYi9saWJzc2gyLnNwZWMKaW5kZXggZGMyZmNmNi4uNzBhYjY5NyAxMDA2NDQKLS0t IGEvbGlic3NoMi5zcGVjCisrKyBiL2xpYnNzaDIuc3BlYwpAQCAtNiw3ICs2LDcgQEAKIAogTmFt ZToJCWxpYnNzaDIKIFZlcnNpb246CTEuMTEuMQotUmVsZWFzZToJOCV7P2Rpc3R9CitSZWxlYXNl Ogk5JXs/ZGlzdH0KIFN1bW1hcnk6CUEgbGlicmFyeSBpbXBsZW1lbnRpbmcgdGhlIFNTSDIgcHJv dG9jb2wKIExpY2Vuc2U6CUJTRC0zLUNsYXVzZQogVVJMOgkJaHR0cHM6Ly93d3cubGlic3NoMi5v cmcvCkBAIC0xNyw2ICsxNyw3IEBAIFNvdXJjZTI6CWh0dHBzOi8vZGFuaWVsLmhheHguc2UvbXlr ZXkuYXNjCiBQYXRjaDA6CQlsaWJzc2gyLTEuMTEuMS1DVkUtMjAyNi03NTk4LnBhdGNoCiBQYXRj aDE6CQk5N2FjZjNkZmRhODBjOTFjM2E4YzlmMjM3MjU0NjMwMWQ0YTFhN2E4LWxpYnNzaDItMS4x MS4xLnBhdGNoCiBQYXRjaDI6CQkxNzYyNjg1N2QyMGIzYzlhMWFkZGZhNDU5NzlkYWRjZWUxY2Q4 NGE0LnBhdGNoCitQYXRjaDM6CQkyZGFlMzAyLWxpYnNzaDItMS4xMS4xLnBhdGNoCiAKIEJ1aWxk UmVxdWlyZXM6CWNvcmV1dGlscwogQnVpbGRSZXF1aXJlczoJZmluZHV0aWxzCkBAIC02OCwxNCAr NjksMjEgQEAgZGV2ZWxvcGluZyBhcHBsaWNhdGlvbnMgdGhhdCB1c2UgbGlic3NoMi4KICMgQ1ZF LTIwMjYtNzU5OCBsaWJzc2gyOiBpbnRlZ2VyIG92ZXJmbG93IHZpYSBsYXJnZSB1c2VybmFtZSBv ciBwYXNzd29yZCBhcmd1bWVudHMKICMgaHR0cHM6Ly9naXRodWIuY29tL2xpYnNzaDIvbGlic3No Mi9wdWxsLzE4NTgKICVwYXRjaCAtUDAKKwogIyBDVkUtMjAyNi01NTIwMCB0cmFuc3BvcnQuYzog QWRkaXRpb25hbCBib3VuZGFyeSBjaGVja3MgZm9yIHBhY2tldCBsZW5ndGgKICMgUGF0Y2ggbW9k aWZpZWQgZm9yIGRvd25zdHJlYW0KICMgaHR0cHM6Ly9naXRodWIuY29tL2xpYnNzaDIvbGlic3No Mi9wdWxsLzIwNTIKICVwYXRjaCAtcDEgLVAxCisKICMgQ1ZFLTIwMjYtNTUxOTkgcGFja2V0LmM6 IGNoZWNrIF9saWJzc2gyX2dldF9zdHJpbmcoKSByZXR1cm4gaW4gRVhUX0lORk8gaGFuZGxlcgog IyBodHRwczovL2dpdGh1Yi5jb20vbGlic3NoMi9saWJzc2gyL3B1bGwvMTg2NAogJXBhdGNoIC1w MSAtUDIKIAorIyBDVkUtMjAyNS0xNTY2MTogSW5mb3JtYXRpb24gZGlzY2xvc3VyZSBhbmQgZGVu aWFsIG9mIHNlcnZpY2UgdmlhIGNyYWZ0ZWQgU0ZUUCByZXNwb25zZQorIyBodHRwczovL2dpdGh1 Yi5jb20vbGlic3NoMi9saWJzc2gyL3B1bGwvMTcwNQorIyBodHRwczovL2dpdGh1Yi5jb20vbGli c3NoMi9saWJzc2gyL3B1bGwvMTcxNworJXBhdGNoIC1wMSAtUDMKKwogIyBSZXBsYWNlIGhhcmQg d2lyZWQgcG9ydCBudW1iZXIgaW4gdGhlIHRlc3Qgc3VpdGUgdG8gYXZvaWQgY29sbGlzaW9ucwog IyBiZXR3ZWVuIDMyLWJpdCBhbmQgNjQtYml0IGJ1aWxkcyBydW5uaW5nIG9uIGEgc2luZ2xlIGJ1 aWxkLWhvc3QKIHNlZCAtaSBzLzQ3MTEvNDclez9fX2lzYV9iaXRzfS8gdGVzdHMve29wZW5zc2hf Zml4dHVyZS5jLHRlc3Rfc3NoezIuYyxkLnRlc3R9fQpAQCAtMTMwLDYgKzEzOCwxMCBAQCBMQ19B TEw9ZW5fVVMuVVRGLTggbWFrZSAtQyB0ZXN0cyBjaGVjawogJXtfbGliZGlyfS9wa2djb25maWcv bGlic3NoMi5wYwogCiAlY2hhbmdlbG9nCisqIFRodSBKdW4gMjUgMjAyNiBQYXVsIEhvd2FydGgg PHBhdWxAY2l0eS1mYW4ub3JnPiAtIDEuMTEuMS05CistIEZpeCBDVkUtMjAyNS0xNTY2MTogSW5m b3JtYXRpb24gZGlzY2xvc3VyZSBhbmQgZGVuaWFsIG9mIHNlcnZpY2UgdmlhIGNyYWZ0ZWQKKyAg U0ZUUCByZXNwb25zZQorCiAqIFR1ZSBKdW4gMjMgMjAyNiBNaWtlbCBPbGFzYWdhc3RpIFVyYW5n YSA8bWlrZWxAb2xhc2FnYXN0aS5pbmZvPiAtIDEuMTEuMS04CiAtIEZpeCBDVkUtMjAyNi01NTIw MCAmIENWRS0yMDI2LTU1MTk5CiAK