From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Paul Howarth To: git-commits@fedoraproject.org Subject: [rpms/libssh2] epel9: Address CVE-2025-15661 Date: Thu, 25 Jun 2026 14:44:04 GMT Message-ID: <178239864493.1.16727080093425709413.rpms-libssh2-13fb9aee68b7@fedoraproject.org> List-ID: X-Git-Repo: rpms/libssh2 X-Git-Branch: epel9 X-Git-Rev: 13fb9aee68b781a29ad5ae4e7a825a0eab20c355 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvbGlic3NoMgogICAgICAgICAgICBCcmFuY2ggOiBlcGVsOQogICAgICAgICAg ICBDb21taXQgOiAxM2ZiOWFlZTY4Yjc4MWEyOWFkNWFlNGU3YTgyNWEwZWFiMjBjMzU1CiAgICAg ICAgICAgIEF1dGhvciA6IFBhdWwgSG93YXJ0aCA8cGF1bEBjaXR5LWZhbi5vcmc+CiAgICAgICAg ICAgIERhdGUgICA6IDIwMjYtMDYtMjVUMTM6MDk6NTArMDE6MDAKICAgICAgICAgICAgU3RhdHMg IDogKzE1MS8tMSBpbiAyIGZpbGUocykKICAgICAgICAgICAgVVJMICAgIDogaHR0cHM6Ly9zcmMu ZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9saWJzc2gyL2MvMTNmYjlhZWU2OGI3ODFhMjlhZDVhZTRl N2E4MjVhMGVhYjIwYzM1NT9icmFuY2g9ZXBlbDkKCiAgICAgICAgICAgIExvZzoKICAgICAgICAg ICAgQWRkcmVzcyBDVkUtMjAyNS0xNTY2MQoKSW5mb3JtYXRpb24gZGlzY2xvc3VyZSBhbmQgZGVu aWFsIG9mIHNlcnZpY2UgdmlhIGNyYWZ0ZWQgU0ZUUCByZXNwb25zZQotIGh0dHBzOi8vZ2l0aHVi LmNvbS9saWJzc2gyL2xpYnNzaDIvcHVsbC8xNzA1Ci0gaHR0cHM6Ly9naXRodWIuY29tL2xpYnNz aDIvbGlic3NoMi9wdWxsLzE3MTcKCi0tLQpkaWZmIC0tZ2l0IGEvMmRhZTMwMi1saWJzc2gyLTEu MTEuMS5wYXRjaCBiLzJkYWUzMDItbGlic3NoMi0xLjExLjEucGF0Y2gKbmV3IGZpbGUgbW9kZSAx MDA2NDQKaW5kZXggMDAwMDAwMC4uN2JhMDc3NAotLS0gL2Rldi9udWxsCisrKyBiLzJkYWUzMDIt bGlic3NoMi0xLjExLjEucGF0Y2gKQEAgLTAsMCArMSwxMzggQEAKK0Zyb20gMmRhZTMwMjQ4OTdl MTg5OGQzODk4MzUxNTFmNGU5NjA2MjI3NzIxZCBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zy b206IFdpbGwgQ29zZ3JvdmUgPHdpbGxAcGFuaWMuY29tPgorRGF0ZTogRnJpLCAxMCBPY3QgMjAy NSAwODoyNjoyMCAtMDcwMAorU3ViamVjdDogW1BBVENIXSBVcGRhdGUgc2Z0cF9zeW1saW5rIHRv IGF2b2lkIG91dCBvZiBib3VuZHMgcmVhZCBvbiBtYWxmb3JtZWQKKyBwYWNrZXQgIzE3MDUgKCMx NzE3KQorCitVc2UgYnVmZmVyIHN0cnVjdCB0byBndWFyZCBhZ2FpbnN0IG91dCBvZiBib3VuZHMg cmVhZHMgYW5kIGludmFsaWQgcGFja2V0cy4KKworRGlzY292ZXJ5IENyZWRpdDoKK0pvc2h1YSBS b2dlcnMKKy0tLQorIHNyYy9zZnRwLmMgfCA2NiArKysrKysrKysrKysrKysrKysrKysrKysrKysr KysrKysrKysrKy0tLS0tLS0tLS0tLS0tLS0KKyAxIGZpbGUgY2hhbmdlZCwgNDcgaW5zZXJ0aW9u cygrKSwgMTkgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1naXQgYS9zcmMvc2Z0cC5jIGIvc3JjL3Nm dHAuYworaW5kZXggNzJiMDA3ZjZlYi4uNzBkNzY4NmRhZiAxMDA2NDQKKy0tLSBhL3NyYy9zZnRw LmMKKysrKyBiL3NyYy9zZnRwLmMKK0BAIC0zNzk1LDE1ICszNzk1LDE5IEBAIHN0YXRpYyBpbnQg c2Z0cF9zeW1saW5rKExJQlNTSDJfU0ZUUCAqc2Z0cCwgY29uc3QgY2hhciAqcGF0aCwKKyB7Cisg ICAgIExJQlNTSDJfQ0hBTk5FTCAqY2hhbm5lbCA9IHNmdHAtPmNoYW5uZWw7CisgICAgIExJQlNT SDJfU0VTU0lPTiAqc2Vzc2lvbiA9IGNoYW5uZWwtPnNlc3Npb247CistICAgIHNpemVfdCBkYXRh X2xlbiA9IDAsIGxpbmtfbGVuOworKyAgICBzaXplX3QgZGF0YV9sZW4gPSAwLCBsa19sZW47Cisg ICAgIC8qIDEzID0gcGFja2V0X2xlbig0KSArIHBhY2tldF90eXBlKDEpICsgcmVxdWVzdF9pZCg0 KSArIHBhdGhfbGVuKDQpICovCisgICAgIHNzaXplX3QgcGFja2V0X2xlbiA9CisgICAgICAgICBw YXRoX2xlbiArIDEzICsKKyAgICAgICAgICgobGlua190eXBlID09IExJQlNTSDJfU0ZUUF9TWU1M SU5LKSA/ICg0ICsgdGFyZ2V0X2xlbikgOiAwKTsKKyAgICAgdW5zaWduZWQgY2hhciAqcywgKmRh dGEgPSBOVUxMOworKyAgICBzdHJ1Y3Qgc3RyaW5nX2J1ZiBidWY7CisgICAgIHN0YXRpYyBjb25z dCB1bnNpZ25lZCBjaGFyIGxpbmtfcmVzcG9uc2VzWzJdID0KKyAgICAgICAgIHsgU1NIX0ZYUF9O QU1FLCBTU0hfRlhQX1NUQVRVUyB9OworICAgICBpbnQgcmV0Y29kZTsKKysgICAgdW5zaWduZWQg Y2hhciBwYWNrZXRfdHlwZTsKKysgICAgdWludDMyX3QgdG1wX3UzMjsKKysgICAgdW5zaWduZWQg Y2hhciAqbGtfdGFyZ2V0OworIAorICAgICBpZihzZnRwLT5zeW1saW5rX3N0YXRlID09IGxpYnNz aDJfTkJfc3RhdGVfaWRsZSkgeworICAgICAgICAgc2Z0cC0+bGFzdF9lcnJubyA9IExJQlNTSDJf RlhfT0s7CitAQCAtMzg5MSw4ICszODk1LDI1IEBAIHN0YXRpYyBpbnQgc2Z0cF9zeW1saW5rKExJ QlNTSDJfU0ZUUCAqc2Z0cCwgY29uc3QgY2hhciAqcGF0aCwKKyAKKyAgICAgc2Z0cC0+c3ltbGlu a19zdGF0ZSA9IGxpYnNzaDJfTkJfc3RhdGVfaWRsZTsKKyAKKy0gICAgaWYoZGF0YVswXSA9PSBT U0hfRlhQX1NUQVRVUykgeworLSAgICAgICAgcmV0Y29kZSA9IF9saWJzc2gyX250b2h1MzIoZGF0 YSArIDUpOworKyAgICBidWYuZGF0YSA9ICh1bnNpZ25lZCBjaGFyICopU1NIMl9VTkNPTlNUKGRh dGEpOworKyAgICBidWYuZGF0YXB0ciA9IGJ1Zi5kYXRhOworKyAgICBidWYubGVuID0gZGF0YV9s ZW47CisrCisrICAgIGlmKF9saWJzc2gyX2dldF9ieXRlKCZidWYsICZwYWNrZXRfdHlwZSkpIHsK KysgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKysgICAgICAgIHJldHVybiBf bGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0wsCisrICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgUHJvdG9jb2wgRXJyb3IgKHR5cGUpIik7 CisrICAgIH0KKysKKysgICAgaWYocGFja2V0X3R5cGUgPT0gU1NIX0ZYUF9TVEFUVVMpIHsKKysg ICAgICAgIGlmKF9saWJzc2gyX2dldF91MzIoJmJ1ZiwgJnRtcF91MzIpKSB7CisrICAgICAgICAg ICAgTElCU1NIMl9GUkVFKHNlc3Npb24sIGRhdGEpOworKyAgICAgICAgICAgIHJldHVybiBfbGli c3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0wsCisrICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICJTRlRQIFByb3RvY29sIEVycm9yIChjb2RlKSIp OworKyAgICAgICAgfQorKworKyAgICAgICAgcmV0Y29kZSA9IChpbnQpdG1wX3UzMjsKKysKKyAg ICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAgICAgICAgIGlmKHJldGNvZGUg PT0gTElCU1NIMl9GWF9PSykKKyAgICAgICAgICAgICByZXR1cm4gTElCU1NIMl9FUlJPUl9OT05F OworQEAgLTM5MDMsMzAgKzM5MjQsMzcgQEAgc3RhdGljIGludCBzZnRwX3N5bWxpbmsoTElCU1NI Ml9TRlRQICpzZnRwLCBjb25zdCBjaGFyICpwYXRoLAorICAgICAgICAgfQorICAgICB9CisgCist ICAgIGlmKF9saWJzc2gyX250b2h1MzIoZGF0YSArIDUpIDwgMSkgeworKyAgICAvKiBhZHZhbmNl IHBhc3QgaWQgKi8KKysgICAgaWYoX2xpYnNzaDJfZ2V0X3UzMigmYnVmLCAmdG1wX3UzMikpIHsK KyAgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAgICAgICAgIHJldHVybiBf bGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0wsCistICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIkludmFsaWQgUkVBRExJTksvUkVBTFBBVEggcmVz cG9uc2UsICIKKy0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAibm8gbmFtZSBlbnRyaWVz Iik7CisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgUHJvdG9jb2wgRXJyb3Ig KGlkKSIpOworICAgICB9CisgCistICAgIGlmKGRhdGFfbGVuIDwgMTMpIHsKKy0gICAgICAgIGlm KGRhdGFfbGVuID4gMCkgeworLSAgICAgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRh KTsKKy0gICAgICAgIH0KKysgICAgLyogbG9vayBmb3IgYXQgbGVhc3Qgb25lIGxpbmsgKi8KKysg ICAgaWYoX2xpYnNzaDJfZ2V0X3UzMigmYnVmLCAmdG1wX3UzMikgfHwgdG1wX3UzMiA8IDEpIHsK KysgICAgICAgIExJQlNTSDJfRlJFRShzZXNzaW9uLCBkYXRhKTsKKyAgICAgICAgIHJldHVybiBf bGlic3NoMl9lcnJvcihzZXNzaW9uLCBMSUJTU0gyX0VSUk9SX1NGVFBfUFJPVE9DT0wsCistICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIlNGVFAgc3RhdCBwYWNrZXQgdG9vIHNob3J0Iik7 CisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJJbnZhbGlkIFJFQURMSU5L L1JFQUxQQVRIIHJlc3BvbnNlLCAiCisrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICJubyBuYW1lIGVudHJpZXMiKTsKKyAgICAgfQorIAorLSAgICAvKiB0aGlzIHJlYWRzIGEg dTMyIGFuZCBzdG9yZXMgaXQgaW50byBhIHNpZ25lZCAzMmJpdCB2YWx1ZSAqLworLSAgICBsaW5r X2xlbiA9IF9saWJzc2gyX250b2h1MzIoZGF0YSArIDkpOworLSAgICBpZihsaW5rX2xlbiA8IHRh cmdldF9sZW4pIHsKKy0gICAgICAgIG1lbWNweSh0YXJnZXQsIGRhdGEgKyAxMywgbGlua19sZW4p OworLSAgICAgICAgdGFyZ2V0W2xpbmtfbGVuXSA9IDA7CistICAgICAgICByZXRjb2RlID0gKGlu dClsaW5rX2xlbjsKKysgICAgaWYoX2xpYnNzaDJfZ2V0X3N0cmluZygmYnVmLCAmbGtfdGFyZ2V0 LCAmbGtfbGVuKSA9PSBMSUJTU0gyX0VSUk9SX05PTkUpIHsKKysgICAgICAgIGlmKGxrX2xlbiA8 IHRhcmdldF9sZW4pIHsKKysgICAgICAgICAgICBtZW1jcHkodGFyZ2V0LCBsa190YXJnZXQsIGxr X2xlbik7CisrICAgICAgICAgICAgdGFyZ2V0W2xrX2xlbl0gPSAnXDAnOworKyAgICAgICAgICAg IHJldGNvZGUgPSAoaW50KWxrX2xlbjsKKysgICAgICAgIH0KKysgICAgICAgIGVsc2UgeworKyAg ICAgICAgICAgIHJldGNvZGUgPSBMSUJTU0gyX0VSUk9SX0JVRkZFUl9UT09fU01BTEw7CisrICAg ICAgICB9CisgICAgIH0KKy0gICAgZWxzZQorLSAgICAgICAgcmV0Y29kZSA9IExJQlNTSDJfRVJS T1JfQlVGRkVSX1RPT19TTUFMTDsKKysgICAgZWxzZSB7CisrICAgICAgICBMSUJTU0gyX0ZSRUUo c2Vzc2lvbiwgZGF0YSk7CisrICAgICAgICByZXR1cm4gX2xpYnNzaDJfZXJyb3Ioc2Vzc2lvbiwg TElCU1NIMl9FUlJPUl9TRlRQX1BST1RPQ09MLAorKyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICJTRlRQIFByb3RvY29sIEVycm9yIChmaWxlbmFtZSkiKTsKKysgICAgfQorKworICAgICBM SUJTU0gyX0ZSRUUoc2Vzc2lvbiwgZGF0YSk7CisgCisgICAgIHJldHVybiByZXRjb2RlOworLS0t IGEvc3JjL2xpYnNzaDJfcHJpdi5oCisrKysgYi9zcmMvbGlic3NoMl9wcml2LmgKK0BAIC0xMTcs NiArMTE3LDE0IEBACisgI2RlZmluZSBVSU5UMzJfTUFYIDB4ZmZmZmZmZmZVCisgI2VuZGlmCisg CisrI2lmZGVmIF9XSU42NAorKyNkZWZpbmUgU1NIMl9VTkNPTlNUKHApICAoKHZvaWQgKikobGli c3NoMl91aW50NjRfdCkoY29uc3Qgdm9pZCAqKShwKSkKKysjZWxpZiBkZWZpbmVkKF9NU0NfVkVS KQorKyNkZWZpbmUgU1NIMl9VTkNPTlNUKHApICAoKHZvaWQgKikodW5zaWduZWQgaW50KShjb25z dCB2b2lkICopKHApKQorKyNlbHNlCisrI2RlZmluZSBTU0gyX1VOQ09OU1QocCkgICgodm9pZCAq KSh1aW50cHRyX3QpKGNvbnN0IHZvaWQgKikocCkpCisrI2VuZGlmCisrCisgI2lmIChkZWZpbmVk KF9fR05VQ19fKSB8fCBkZWZpbmVkKF9fY2xhbmdfXykpICYmIFwKKyAgICAgZGVmaW5lZChfX1NU RENfVkVSU0lPTl9fKSAmJiAoX19TVERDX1ZFUlNJT05fXyA+PSAxOTk5MDFMKSAmJiBcCisgICAg ICFkZWZpbmVkKExJQlNTSDJfTk9fRk1UX0NIRUNLUykKCmRpZmYgLS1naXQgYS9saWJzc2gyLnNw ZWMgYi9saWJzc2gyLnNwZWMKaW5kZXggZGMyZmNmNi4uNzBhYjY5NyAxMDA2NDQKLS0tIGEvbGli c3NoMi5zcGVjCisrKyBiL2xpYnNzaDIuc3BlYwpAQCAtNiw3ICs2LDcgQEAKIAogTmFtZToJCWxp YnNzaDIKIFZlcnNpb246CTEuMTEuMQotUmVsZWFzZToJOCV7P2Rpc3R9CitSZWxlYXNlOgk5JXs/ ZGlzdH0KIFN1bW1hcnk6CUEgbGlicmFyeSBpbXBsZW1lbnRpbmcgdGhlIFNTSDIgcHJvdG9jb2wK IExpY2Vuc2U6CUJTRC0zLUNsYXVzZQogVVJMOgkJaHR0cHM6Ly93d3cubGlic3NoMi5vcmcvCkBA IC0xNyw2ICsxNyw3IEBAIFNvdXJjZTI6CWh0dHBzOi8vZGFuaWVsLmhheHguc2UvbXlrZXkuYXNj CiBQYXRjaDA6CQlsaWJzc2gyLTEuMTEuMS1DVkUtMjAyNi03NTk4LnBhdGNoCiBQYXRjaDE6CQk5 N2FjZjNkZmRhODBjOTFjM2E4YzlmMjM3MjU0NjMwMWQ0YTFhN2E4LWxpYnNzaDItMS4xMS4xLnBh dGNoCiBQYXRjaDI6CQkxNzYyNjg1N2QyMGIzYzlhMWFkZGZhNDU5NzlkYWRjZWUxY2Q4NGE0LnBh dGNoCitQYXRjaDM6CQkyZGFlMzAyLWxpYnNzaDItMS4xMS4xLnBhdGNoCiAKIEJ1aWxkUmVxdWly ZXM6CWNvcmV1dGlscwogQnVpbGRSZXF1aXJlczoJZmluZHV0aWxzCkBAIC02OCwxNCArNjksMjEg QEAgZGV2ZWxvcGluZyBhcHBsaWNhdGlvbnMgdGhhdCB1c2UgbGlic3NoMi4KICMgQ1ZFLTIwMjYt NzU5OCBsaWJzc2gyOiBpbnRlZ2VyIG92ZXJmbG93IHZpYSBsYXJnZSB1c2VybmFtZSBvciBwYXNz d29yZCBhcmd1bWVudHMKICMgaHR0cHM6Ly9naXRodWIuY29tL2xpYnNzaDIvbGlic3NoMi9wdWxs LzE4NTgKICVwYXRjaCAtUDAKKwogIyBDVkUtMjAyNi01NTIwMCB0cmFuc3BvcnQuYzogQWRkaXRp b25hbCBib3VuZGFyeSBjaGVja3MgZm9yIHBhY2tldCBsZW5ndGgKICMgUGF0Y2ggbW9kaWZpZWQg Zm9yIGRvd25zdHJlYW0KICMgaHR0cHM6Ly9naXRodWIuY29tL2xpYnNzaDIvbGlic3NoMi9wdWxs LzIwNTIKICVwYXRjaCAtcDEgLVAxCisKICMgQ1ZFLTIwMjYtNTUxOTkgcGFja2V0LmM6IGNoZWNr IF9saWJzc2gyX2dldF9zdHJpbmcoKSByZXR1cm4gaW4gRVhUX0lORk8gaGFuZGxlcgogIyBodHRw czovL2dpdGh1Yi5jb20vbGlic3NoMi9saWJzc2gyL3B1bGwvMTg2NAogJXBhdGNoIC1wMSAtUDIK IAorIyBDVkUtMjAyNS0xNTY2MTogSW5mb3JtYXRpb24gZGlzY2xvc3VyZSBhbmQgZGVuaWFsIG9m IHNlcnZpY2UgdmlhIGNyYWZ0ZWQgU0ZUUCByZXNwb25zZQorIyBodHRwczovL2dpdGh1Yi5jb20v bGlic3NoMi9saWJzc2gyL3B1bGwvMTcwNQorIyBodHRwczovL2dpdGh1Yi5jb20vbGlic3NoMi9s aWJzc2gyL3B1bGwvMTcxNworJXBhdGNoIC1wMSAtUDMKKwogIyBSZXBsYWNlIGhhcmQgd2lyZWQg cG9ydCBudW1iZXIgaW4gdGhlIHRlc3Qgc3VpdGUgdG8gYXZvaWQgY29sbGlzaW9ucwogIyBiZXR3 ZWVuIDMyLWJpdCBhbmQgNjQtYml0IGJ1aWxkcyBydW5uaW5nIG9uIGEgc2luZ2xlIGJ1aWxkLWhv c3QKIHNlZCAtaSBzLzQ3MTEvNDclez9fX2lzYV9iaXRzfS8gdGVzdHMve29wZW5zc2hfZml4dHVy ZS5jLHRlc3Rfc3NoezIuYyxkLnRlc3R9fQpAQCAtMTMwLDYgKzEzOCwxMCBAQCBMQ19BTEw9ZW5f VVMuVVRGLTggbWFrZSAtQyB0ZXN0cyBjaGVjawogJXtfbGliZGlyfS9wa2djb25maWcvbGlic3No Mi5wYwogCiAlY2hhbmdlbG9nCisqIFRodSBKdW4gMjUgMjAyNiBQYXVsIEhvd2FydGggPHBhdWxA Y2l0eS1mYW4ub3JnPiAtIDEuMTEuMS05CistIEZpeCBDVkUtMjAyNS0xNTY2MTogSW5mb3JtYXRp b24gZGlzY2xvc3VyZSBhbmQgZGVuaWFsIG9mIHNlcnZpY2UgdmlhIGNyYWZ0ZWQKKyAgU0ZUUCBy ZXNwb25zZQorCiAqIFR1ZSBKdW4gMjMgMjAyNiBNaWtlbCBPbGFzYWdhc3RpIFVyYW5nYSA8bWlr ZWxAb2xhc2FnYXN0aS5pbmZvPiAtIDEuMTEuMS04CiAtIEZpeCBDVkUtMjAyNi01NTIwMCAmIENW RS0yMDI2LTU1MTk5CiAK