mikrotik-backup/vendor/libssh2-sys/PROVENANCE.md

Vendored libssh2 security backports

This directory contains the compilation sources of libssh2-sys 0.3.3 from crates.io, with narrowly scoped libssh2 security backports. The application uses it through Cargo's [patch.crates-io] mechanism. It is not a new upstream release and does not claim to be libssh2 1.11.2.

Source identity and licensing

• Published package: https://crates.io/crates/libssh2-sys/0.3.3.
• Original archive: https://static.crates.io/crates/libssh2-sys/libssh2-sys-0.3.3.crate.
• Archive SHA-256: 0f5eb74291e8691cab524a01274a1b1e7742b1a94f29d8b101d8aadc8372c1cd.
• Wrapper repository revision: 1abdbdb031cfea7e9e3dca7980ea36845bba1da8.
• Bundled libssh2 revision: 090f23d1852a0b62e081bd12c4d05adc1c4af47a.
• Wrapper license: LICENSE-MIT or LICENSE-APACHE, preserved verbatim.
• Native library license and additional notices: libssh2/COPYING, libssh2/LICENSES/, and the original source headers, preserved verbatim.

Only files needed by the original Cargo build and licenses were copied. Upstream examples, CI files, manuals and unrelated build-system files are omitted. The original Rust FFI source and C headers are unchanged. The small tests in this directory are new regression checks for this distribution, licensed under MIT.

The published source is based on libssh2 1.11.1 and already includes backports for CVE-2025-15661, CVE-2026-55199 and CVE-2026-55200, plus the SFTP status follow-up 4ed26f5740bdd409269ed9fb48a28bf8f565b681. Those fixes are retained.

Additional patches

The unmodified upstream patch downloads are in patches/upstream/. patches/upstream-manifest.json records each URL, full commit and SHA-256.

Issue	Upstream commit	Change carried into the bundled code
CVE-2026-7598	256d04b60d80	Reject overflowing username lengths in authentication APIs; correct the password-change length comparison.
CVE-2026-66032	5e4776146552	Null the freed SFTP response pointer before waiting for a handle response.
CVE-2026-66033	a2ed82d40964	Apply AES-GCM bounds checks in release builds before computing the cipher length.
CVE-2026-66034	a13bb6c773f0	Check remaining publickey response data before consuming a server-supplied comment length.
CVE-2026-66035	42e33d81577e	Reject an ETM packet too short for its MAC, length and first cipher block before decrypting.
CVE-2026-58050	34497525929b	Bound publickey attribute count to 1024 before multiplying for allocation.
CVE-2026-58051	a9758da45a52	Initialize newly allocated publickey list entries before error cleanup can inspect them.
Publickey cleanup follow-up	c2f1a3a21b4c	Initialize all new entries and free partially initialized attribute allocations.
Publickey terminator follow-up	ad16eb112f4a	Include the reserved terminator entry in zero-initialization.

Upstream renamed private symbols after the bundled base revision. Backports use the corresponding old _libssh2_* / LIBSSH2_* names and local formatting. Upstream SSH2_SAFEFREE(session, p->payload) is represented by the equivalent LIBSSH2_FREE(session, p->payload); p->payload = NULL;. The three publickey initialization/cleanup patches are combined into their final corrected form. These mechanical adaptations do not change their conditions or error codes.

Reproducible patch and build selection

patches/security-backports.patch applies to an extracted, original 0.3.3 crate with patch -p1. Its SHA-256 is:

b6f970cfc5749e0ba35695b7d49b0774a191779d159a438249f9065ecc8a88bd

Replay was checked on a fresh copy: all seven modified files were byte-identical to the shipped source. SHA256SUMS covers the shipped vendor files except the checksum list itself. Verify it from this directory with sha256sum -c SHA256SUMS.

build.rs always compiles the bundled C source. It rejects LIBSSH2_SYS_USE_PKG_CONFIG; automatic vcpkg fallback and the build-time Git submodule command are removed. Source/header changes trigger a rebuild. This prevents a local system libssh2 from silently replacing the corrected source. OpenSSL and zlib remain the original supported backend dependencies. Their operating-system packages require the usual security maintenance.

The wrapper manifest is marked publish = false; unused pkg-config/vcpkg direct build dependencies are removed. All other wrapper features and dependencies are preserved.

Regression verification

After a Linux Cargo build, use the archive emitted by this exact path dependency:

vendor/libssh2-sys/tests/run-security-regressions.sh \
  /absolute/path/to/target/debug/build/libssh2-sys-<build-id>/out/build/libssh2.a

The test passes deliberately malformed short and oversized AES-GCM blocks and overflowing username lengths, without a network connection. It requires a C compiler and the OpenSSL/zlib development libraries used by the normal build. The application integration tests separately exercise real SSH, SFTP, SCP, configuration export and binary upload against a local SSH server.

The published README.md records which checks were actually run. A clean RustSec report alone does not audit bundled C code, prove absence of other vulnerabilities, or replace device testing.