Ubuntu alert USN-8532-1 (libssh2)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8532-1] libssh2 vulnerabilities
Date:
             
 
Mon, 13 Jul 2026 14:00:37 +0000
Message-ID:
             
 
<E1wjHD3-000706-K7@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8532-1
July 13, 2026

libssh2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS

Summary:

Several security issues were fixed in libssh2.

Software Description:
- libssh2: Client-side C library implementing the SSH2 protocol

Details:

It was discovered that libssh2 incorrectly handled certain publickey
subsystem attributes. A remote attacker controlling a malicious SSH server
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2026-58050)

It was discovered that libssh2 did not properly initialize publickey list
entries before parsing. A remote attacker controlling a malicious SSH
server could use this issue to cause a denial of service or possibly
execute arbitrary code. (CVE-2026-58051)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libssh2-1t64                    1.11.1-1ubuntu0.26.04.3

Ubuntu 24.04 LTS
  libssh2-1t64                    1.11.0-4.1ubuntu0.24.04.3

In general, a standard system update will make all the necessary
changes.

References:
  https://ubuntu.com/security/notices/USN-8532-1
  CVE-2026-58050, CVE-2026-58051

Package Information:
  https://launchpad.net/ubuntu/+source/libssh2/1.11.1-1ubun...
  https://launchpad.net/ubuntu/+source/libssh2/1.11.0-4.1ub...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpU7dsACgkQcpJm3tlz
hgH/JQ//fqX74Lez+NOnUQRVwyQLgL/cCRA9sVUj6JN6q7NZk22sES2QuL0/bFJ6
RbYQVM5mqsFNMtQpPq7lz0LRU9S9nffufU2OMmHJK/bMRgF8vcFjFEqOuRefGGkA
pnLvpiOKgSr9HMWJdo6nFvr3khZEjEbN+c5Cf4crC3L6k9Eaf7Zo0shkQQZch595
7r1AeCXtgoI4l1KJMs1cQF93iSUIx2NmJQMTxrBVGLrO6gCCUa25VkHAAUddDstq
6PwXsK9k5yuYfBY8Zjhu5uOyr/dIicrLO7u55CRog8EXsnJ01O0DVd1Rx5jTx/b9
xzdgwHaAHY/83TBE8KB7gV9GJRXTq0co8YKk13mgbEAVn8i8HuUkKio0YYd5Jv1Q
TuA7jwBbfPU8NljwxogH5iGW8P15YN2ibtz2C9HGl/ZTnmKmTeNexuKN67EwTV96
7PaEe9VhtGbgOZDTZtvcAnQrOPMcl3yhyTuPdlwSUWlL+gZmmuwQSYmhvAfqZecr
WH2w5LxyWluPp57+0PcmDLpYYFnYHt0eoMaUyxv3eGdRU1vgGawTMT4C1Ae8DEH3
Efi/egDsOWnMpbQBNYqsD3jy3Sig1ndb3hbWaIDuxnYefXExDRl+GtffhgmK1l4G
W/Di/7bcFUNupyJUWbf1MOx4tIUTTGHpKVJoI48Eq8mOvq3jPnM=
=EJDm
-----END PGP SIGNATURE-----