===========================================================
== Subject:     Integrity downgrade of AES-GCM ciphers
==
== CVE ID#:     CVE-2026-59847
==
== Versions:    libssh >= 0.9.0;  < 0.12.1;  < 0.11.5
==
== Summary:     Wrong integrity check in AES-GCM OpenSSL backend
==              allows silent plaintext modification
==
== Component:   server+client, OpenSSL only
==
===========================================================

===========
Description
===========

Wrong check of OpenSSL's EVP_DecryptFinal() return value downgrades
the AES-GCM encryption to AES-CTR (without any additional integrity
checks), which allows the in-path attacker to modify bytes on the
wire without being detected.

Successful attack requires the attacker to flip bits based on expected
plaintext format of the packets. This includes modification of files
transferred through SFTP, downgrade of security by changing server
advertised SSH extensions (SSH_MSG_EXT_INFO packet is placed at
predictable order in the conversation), or change of the executed
commands over the SSH channel.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L (6.5)

==========
Workaround
==========

Disable the `aes128-gcm@openssh.com` and `aes256-gcm@openssh.com` ciphers.

=======
Credits
=======

Originally reported and patches provided by Ben Smyth.

==========================================================
== The libssh team
==========================================================