[PATCH] libssh: Update to version 0.12.2

[Adolf Belka <adolf.belka@ipfire.org>]

- Update from version 0.11.3 to 0.12.2
- Update of rootfile
- 17 CVE fixes in total -1 in 0.12.2, 10 in 0.12.1 and 6 in 0.11.4
- Changelog
0.12.2
 * Security:
   * CVE-2026-59843: Denial of service via zero advertised channel packet size
     (accidentally missed from previous release backports)
 * Bugfixes:
   * Fix fallback to default provider if FIPS provider does not have ML-KEM
     implementation
   * Do not override explicitly set options through a configuration file to
     match OpenSSH behavior.
   * Return SSH_KNOWN_HOSTS_UNKNOWN when GSSAPI key exchange is used without any
     hostkey
 * New API:
   * API to check the GSSAPI key exchange was used for hostkey handling
   * API to initiate GSSAPI keyex authentication (missing from last release)
0.12.1
 * Security:
   * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
   * CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
   * CVE-2026-59844: Denial of service via oversized SFTP read length
   * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
   * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
   * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
   * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
   * CVE-2026-59849: Denial of service via automatic certificate authentication loop
   * CVE-2026-59850: Use-after-free via data callbacks on closed channels
   * CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
   * Zero-initialize every ssh_string
 * Compatibility:
   * Fix compatibility with C23 / gcc16
   * Allow hybrid ML-KEM key exchange in FIPS mode
 * Bugfixes:
   * Fix multiple memory leaks, null checks, and error checks
   * Fix parameter size mismatch in mlkem768x25519-sha256
   * Fix client SFTP messages being ignored if sent at high rate
   * Validate peer public key in DH key exchange
   * Fix ambiguous error reporting of sftp_init
   * Fix hidden integer underflow in socket packet callback
   * Avoid remote window overflow
   * Fix socket data callback return value on rekey failure
   * Avoid off-by-one overflow during kbdint authentication
   * Avoid logging uninitialized sequence numbers
   * Avoid double conversion of SFTP version number
   * Send correct SFTP server version number
   * Avoid handling repeated SFTP INIT messages
   * Harmonize return values from SFTP server callbacks
0.12.0
 * Deprecations and removals:
   * Bumped minimal RSA key size to 1024 bits
 * New functionality:
   * Add support for hybrid key exchange mechanisms using Quantum Resistant
     cryptography for all backends. These are now preferred:
     * sntrup761x25519-sha512, sntrup761x25519-sha512@openssh.com
     * mlkem768nistp256-sha256
     * mlkem768x25519-sha256
     * mlkem1024nistp384-sha384 (only OpenSSL 3.5+ and libgcrypt)
   * New cmake option WITH_HERMETIC_USR
   * Added support for Ed25519 keys through PKCS#11
   * Support for host-bound public key authentication
     (publickey-hostbound-v00@openssh.com)
   * Use curve25519 implementation from mbedTLS and libgcrypt
   * New functions for signing arbitrary data (commits) with SSH keys
     * sshsig_sign()
     * sshsig_verify()
   * Support for FIDO/U2F keys (internal implementation using libfido2)
     * Compatible with OpenSSH: should work out of the box
     * Extensible with callbacks
   * Add support for GSSAPI Key Exchange (RFC 4462, RFC 8732)
   * Add support for new configuration options (client and server):
     * RequiredRsaSize
     * AddressFamily (client)
     * GSSAPIKeyExchange
     * GSSAPIKexAlgorithms
   * New option to get list of configured identities (SSH_OPTIONS_NEXT_IDENTITY)
   * More OpenSSH compatible percent expansion characters
   * Add new server auth_kbdint_function() callback
   * New PKI Context structure for key operations
   * Stability and compatibility improvements of ProxyJump
 * SFTP
   * Prevent failures when SFTP status message does not contain error message
   * Fix possible timeouts while waiting for SFTP messages
   * Support for users-groups-by-id@openssh.com extension in client
   * Support for SSH_FXF_TRUNC in server
0.11.4
 * Security:
   * CVE-2025-14821: libssh loads configuration files from the C:\etc directory
     on Windows
   * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
   * CVE-2026-0965: Possible Denial of Service when parsing unexpected
     configuration files
   * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
   * CVE-2026-0967: Specially crafted patterns could cause DoS
   * CVE-2026-0968: OOB Read in sftp_parse_longname()
   * libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP
     extensions
 * Stability and compatibility improvements of ProxyJump

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/libssh | 2 +-
 lfs/libssh                     | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/rootfiles/common/libssh b/config/rootfiles/common/libssh
index d0b55519f..f1c62b25a 100644
--- a/config/rootfiles/common/libssh
+++ b/config/rootfiles/common/libssh
@@ -14,5 +14,5 @@
 #usr/lib/cmake/libssh/libssh-config.cmake
 #usr/lib/libssh.so
 usr/lib/libssh.so.4
-usr/lib/libssh.so.4.10.3
+usr/lib/libssh.so.4.12.0
 #usr/lib/pkgconfig/libssh.pc
diff --git a/lfs/libssh b/lfs/libssh
index 26d41dd38..90e0618c6 100644
--- a/lfs/libssh
+++ b/lfs/libssh
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 0.11.3
+VER        = 0.12.2
 
 THISAPP    = libssh-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 859e4af9bf6305e54175e456d153a85e678a6fc49ac184dbe09d94ab01dde42f0321f5a2ac35cf4ca9df188daab6c4bf3171dcd8a3776419a3a1a20474ccf89a
+$(DL_FILE)_BLAKE2 = 1cb3b2b05e399181dd215502bb1802fb8d428249f809ba166a90903f67825dac1d4639d57177b3f820529759f61a58e58a51d3502e24ef68c86e4804f4c8b738
 
 install : $(TARGET)
 
-- 
2.56.1