2026.93 with one security fix, some minor hardening, and the configuration patch gone upstream:
- Security: Fix a use-after-free in X11 forwarding that could possibly lead to memory corruption. This is vulnerable to authenticated users if X11 forwarding is enabled. By default X11 forwarding is not built. In 2026.89 the server is running as the authenticated user for X11 forwarding, in earlier versions it runs as root. This removes X11 "single connection" which has probably never been used. Reported by @peter-pe https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4 2026.94 fixing a build regression introduced in 2026.93 and some minor improvements. Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.93 Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.94 Signed-off-by: Alexander Dahl <[email protected]> --- ...nfigure-Fix-deprecated-plugin-option.patch | 109 ------------------ patches/dropbear-2026.92/series | 4 - rules/dropbear.make | 4 +- 3 files changed, 2 insertions(+), 115 deletions(-) delete mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch delete mode 100644 patches/dropbear-2026.92/series diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch deleted file mode 100644 index d12d292d2..000000000 --- a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch +++ /dev/null @@ -1,109 +0,0 @@ -From: Alexander Dahl <[email protected]> -Date: Wed, 8 Jul 2026 13:02:37 +0200 -Subject: [PATCH] configure: Fix (deprecated) plugin option - -Actually two issues here. - -On one hand there was the incomplete rename from --enable-plugin to ---enable-plugin-deprecated triggering new warnings with -dropbear-2026.92. Technically new options where ignored while the old ---enable-plugin and --disable-plugin where still considered. - -On the other hand the previous option was broken from the beginning, -because when passing --enable-plugin or --disable-plugin explicitly the -option was not evaluated correctly. - -Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html -Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)") -Fixes: #298 -Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated") -Signed-off-by: Alexander Dahl <[email protected]> -Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462] ---- - configure | 23 +++++++++++++++++------ - configure.ac | 15 +++++++++++---- - 2 files changed, 28 insertions(+), 10 deletions(-) - -diff --git a/configure b/configure -index b8e90be06083..9b7b9b56f6f4 100755 ---- a/configure -+++ b/configure -@@ -736,7 +736,7 @@ enable_pam - enable_openpty - enable_syslog - enable_shadow --enable_plugin -+enable_plugin_deprecated - enable_fuzz - enable_bundled_libtom - enable_lastlog -@@ -5838,22 +5838,33 @@ fi - - - # Plugin support will be removed soon. Open a github issue if you're using it. --# Check whether --enable-plugin was given. --if test ${enable_plugin+y} -+# Check whether --enable-plugin-deprecated was given. -+if test ${enable_plugin_deprecated+y} - then : -- enableval=$enable_plugin; -+ enableval=$enable_plugin_deprecated; -+ if test "x$enableval" = "xyes"; then - - printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h - -- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 - printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;} -- DROPBEAR_PLUGIN=1 -+ DROPBEAR_PLUGIN=1 -+ else -+ -+printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h -+ -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} -+ DROPBEAR_PLUGIN=0 -+ fi - - else $as_nop - - - printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h - -+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 -+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} - DROPBEAR_PLUGIN=0 - - -diff --git a/configure.ac b/configure.ac -index 25a13ee78e88..6dfeacf1f57f 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow, - ) - - # Plugin support will be removed soon. Open a github issue if you're using it. --AC_ARG_ENABLE(plugin, -+AC_ARG_ENABLE(plugin-deprecated, - [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])], - [ -- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) -- AC_MSG_NOTICE(Enabling support for External Public Key Authentication) -- DROPBEAR_PLUGIN=1 -+ if test "x$enableval" = "xyes"; then -+ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) -+ AC_MSG_NOTICE(Enabling support for External Public Key Authentication) -+ DROPBEAR_PLUGIN=1 -+ else -+ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) -+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) -+ DROPBEAR_PLUGIN=0 -+ fi - ], - [ - AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) -+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) - DROPBEAR_PLUGIN=0 - ] - diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series deleted file mode 100644 index b8f33b5c2..000000000 --- a/patches/dropbear-2026.92/series +++ /dev/null @@ -1,4 +0,0 @@ -# generated by git-ptx-patches -#tag:base --start-number 1 -0001-configure-Fix-deprecated-plugin-option.patch -# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic diff --git a/rules/dropbear.make b/rules/dropbear.make index 3dded0d5b..eb720532d 100644 --- a/rules/dropbear.make +++ b/rules/dropbear.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear # # Paths and names # -DROPBEAR_VERSION := 2026.92 -DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e +DROPBEAR_VERSION := 2026.94 +DROPBEAR_SHA256 := e098034a843699200c8c977a991fff73159735bf795d5f72ef672c41a6b1ae81 DROPBEAR := dropbear-$(DROPBEAR_VERSION) DROPBEAR_SUFFIX := tar.bz2 DROPBEAR_URL := \ base-commit: fccbfeb4cf9fbf8a6e53d5deb5fc45d9de70aaff -- 2.47.3
