[AutoPR- Security] Patch libssh for CVE-2026-59850, CVE-2026-59847, CVE-2026-59845, CVE-2026-59844, CVE-2026-59843, CVE-2026-59848 [MEDIUM]

[azurelinux-security]

Auto Patch libssh for CVE-2026-59850, CVE-2026-59847, CVE-2026-59845, CVE-2026-59844, CVE-2026-59843, CVE-2026-59848.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1169536&view=results
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1169569&view=results

CVE-2026-59850 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1169543&view=results
CVE-2026-59847 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1169542&view=results
CVE-2026-59843 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1169547&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch libssh for CVE-2026-59850 (MEDIUM), CVE-2026-59847 (MEDIUM), CVE-2026-59845 (MEDIUM), CVE-2026-59844 (MEDIUM), CVE-2026-59843 (MEDIUM), CVE-2026-59848 (MEDIUM).

Change Log

• CVE-2026-59850
• CVE-2026-59847
• CVE-2026-59845
• CVE-2026-59844
• CVE-2026-59843
• CVE-2026-59848

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-59850
• https://nvd.nist.gov/vuln/detail/CVE-2026-59847
• https://nvd.nist.gov/vuln/detail/CVE-2026-59845
• https://nvd.nist.gov/vuln/detail/CVE-2026-59844
• https://nvd.nist.gov/vuln/detail/CVE-2026-59843
• https://nvd.nist.gov/vuln/detail/CVE-2026-59848

Test Methodology

• Pipeline build id: Buddy Build URL
• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[v-sushilsati]

Patch Analysis:
CVE-2026-59843:
Backported: No (AI patch is ok)
Patch matches with upstream patch. all hunks succeeded without issues. Affected code is present.
CVE-2026-59845:
Backported: No (AI patch is ok)
Patch matches with upstream patch. all hunks succeeded without issues. Affected code is present.
CVE-2026-59850:
Backported: No (AI patch is ok)
Patch matches with upstream patch. all hunks succeeded without issues. Affected code is present.
CVE-2026-59844
Backported: YES.
Affected code is present.
AI patch is giving following error.

Resolved using Older 0.10.6 cleanup uses, equivalent to upstream’s goto error.

CVE-2026-59847
Backported: YES.
Affected code is present.
Removed the unrelated and incorrect encryption hunk.
CVE-2026-59848
Backported: YES.
Affected code is present.

Upstream patch link in astrolabe is incomplete following two patches required. AI patch contains both patch reference.
https://git.libssh.org/projects/libssh.git/patch/?id=9563afc950f473daa355ca594e2e5f4d520460ac

Missing patch https://git.libssh.org/projects/libssh.git/patch/?id=e3dc89de9754790e49b26f03b70e8e4acc88bde
The AI patch failed because it missed required changes in sftp_priv.h, CMakeLists.txt, and torture_sftp_request_id.c, while incorrectly modifying sftp.c. To resolve the resulting build errors, the upstream patches were applied manually with the following modifications:

1. Upstream changes to /src/sftp_common.c (modifying sftp_get_message and adding sftp_get_new_id) were backported to sftp.c because sftp_common.c is not present in libssh-0.10.6. The upstream logic was successfully integrated into the existing sftp_get_message function, and sftp_get_new_id was appended to sftp.c.
2. The upstream patch introduces a new test file, tests/client/torture_sftp_request_id.c. This file was successfully integrated because all four included test cases are fully applicable to libssh-0.10.6. Since test execution is already enabled in our spec file.

3. In the upstream torture_sftp_request_id.c file, the test suite calls sftp_recv_response_msg(), a function that does not exist in libssh-0.10.6. To resolve this for the backport, that call was replaced with its 0.10.6 equivalent
   rc = sftp_read_and_dispatch(sftp);
   assert_int_equal(rc, -1);

4. remove the unused declaration from torture_sftp_request_id.c
   sftp_message msg = NULL;

5. However, its four added test cases did not execute. They are failing with SSH server group setup with free(): invalid pointer and connection resets.
   causing connection resets before the tests run. Seem some environmental issue not the patch issue.

6. Existing all test torture_* is also failing with same reason. The exact same behaviour was also reproduced on a separate 3.0-dev branch RPM baseline build.
   Result on 3.0-dev

0 test(s) run, so sftp_fsync() is never tested.

Result on this modified PR branch

7. Following function from upstream are not present in libssh 0.10.6 sftp.c and excluded from the backport.
   sftp_lsetstat, sftp_hardlink, sftp_limits_use_extension, sftp_expand_path, sftp_home_directory, sftp_get_users_groups_by_id

8. The following files do not exist in the libssh-0.10.6 codebase. Consequently, their corresponding upstream modifications were excluded from this backport.
   /src/sftp_aio.c
   /src/sftp_common.c
   /tests/server/torture_sftpserver.c

9. The patches have been successfully applied and build has been passed.

10. buddy build has passed : https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1171321&view=results

[Kanishk-Bansal]

Patch Analysis (
CVE-2026-59847 core logic matches upstream
CVE-2026-59843 core logic matches upstream
CVE-2026-59845 matches upstream
CVE-2026-59844 matches upstream
CVE-2026-59848 core logic matches upstream
CVE-2026-59850 core logic matches upstream)

• Buddy Build 
• patch applied during the build (check rpm.log)
• patch include an upstream reference
• PR has security tag