Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

libssh/libssh-mirror

              master @ 26c5942
            

176

Fixes

CVEs

CRITICAL

Peak severity

27.8%

Coverage

Highlights

Denial of Service: 24 prior fixes. Scrutinize any change in this area.

src/auth.c: most-fixed (18 issues). Treat as high-risk during review.

125 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication Bypass: Multiple critical bypasses from improper auth state tracking (CVE-2018-10933) and missing state validation on channel/packet messages. Recurring pattern of accepting SSH_MSG_USERAUTH_SUCCESS without verifying the actual auth method completed.

Buffer Overflow / Memory Corruption: Recurring integer overflows and missing bounds checks in buffer operations, SFTP packet parsing, and key import. Many fixes involve converting to size_t, adding overflow guards, and checking return values from ssh_buffer_* functions.

Command Injection: Usernames and file paths are embedded into shell commands (proxycommand, scp). Multiple fixes added metacharacter filtering and quoting, but each was incomplete, requiring successive patches.