Fix CVE-2019-13115

[Giovanni Vecchi]

As per CVE-2019-13115 (https://ubuntu.com/security/CVE-2019-13115) and GitHub security protocol improvement (https://github.blog/2021-09-01-improving-git-protocol-security-github/), libssh2 should be upgraded at least to 1.9.0: when it will be done at least for LTS versions?

[Alex Murray (alexmurray)]

As per https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions in Ubuntu we do not generally upgrade software package versions to fix security vulnerabilityies - instead we backport patches to fix the issue directly on the existing version of the package in the respective Ubuntu release. So libssh2 will not be upgraded to fix this CVE.

[Alex Murray (alexmurray)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Giovanni Vecchi (g.vecchi)]

Dear Alex,

thanks for your confirmation, but I'm not able to coordinate a bug fix.
How to ask for a backport in order to take advantage of new features and be able to connect to github throught libgit2 and other Git clients?

Thanks

[Alex Murray (alexmurray)]

To request a backport you could try https://wiki.ubuntu.com/UbuntuBackports

[Giovanni Vecchi (g.vecchi)]

I'm unable to maintain a backported package: I will wait for 22.04 release.
This bug can be archived.
Thanks