Release date:
2026-08-04 10:23:32 UTC
Description:
* SECURITY UPDATE: authentication tag verification bypass in the AES-GCM
ciphers, allowing forged or tampered packets to be accepted as
authentic
- debian/patches/CVE-2026-59847.patch: treat an EVP_DecryptFinal()
return value of 0 as an authentication failure (reject
rc != 1 || outlen != 0) in evp_cipher_aead_decrypt(), and apply the
symmetric fix to evp_cipher_aead_encrypt() so an EVP_EncryptFinal()
return value of 0 is no longer treated as success (reject rc != 1),
both in src/libcrypto.c
- CVE-2026-59847
Updated packages:
-
libssh-4_0.9.3-2ubuntu2.5+tuxcare.els6_amd64.deb
sha:b70c5d830a72a4a70affcbb208eeac80aebda91f
-
libssh-dev_0.9.3-2ubuntu2.5+tuxcare.els6_amd64.deb
sha:f1c8c4cfdc4a88ff1c7eefd1c8c582ed9e3b9c98
-
libssh-doc_0.9.3-2ubuntu2.5+tuxcare.els6_all.deb
sha:c5da2918fe9a52c574a8efc7159bdc315f87b657
-
libssh-gcrypt-4_0.9.3-2ubuntu2.5+tuxcare.els6_amd64.deb
sha:e7a8e90e6a755cd7a6dd658125cee0bcd9660790
-
libssh-gcrypt-dev_0.9.3-2ubuntu2.5+tuxcare.els6_amd64.deb
sha:e003009db04a5fccde5e4a3af75c52bfc7ec1c82
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
