From: Alexander Dahl via ptxdist <ptxdist@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: Alexander Dahl <ada@thorsis.com>
Subject: [ptxdist] [PATCH] dropbear: version bump 2026.91 -> 2026.92
Date: Wed, 8 Jul 2026 13:47:33 +0200 [thread overview]
Message-ID: <20260708114733.3505462-1-ada@thorsis.com> (raw)
Two security fixes. Adding a patch for a build issue.
Noteworthy compatibility/configuration changes from the changelog:
- >> server auth plugins have been deprecated, the configure option
has been renamed to --enable-plugin-deprecated.
Planned to be removed in future.
- >> Two factor auth "-t" has been deprecated, it now requires
a configuration option DEPRECATED_TWO_FACTOR.
Planned to be removed in future.
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6
Reported by nvidia
- >> authorized_keys is now limited to 300 lines.
- >> all programs and scp: Disallow following symlinks when writing output
files. This could prevent symlink attacks. Writing keys to an untrusted
directory is not recommended regardless.
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
...nfigure-Fix-deprecated-plugin-option.patch | 109 ++++++++++++++++++
patches/dropbear-2026.92/series | 4 +
rules/dropbear.make | 6 +-
3 files changed, 116 insertions(+), 3 deletions(-)
create mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
create mode 100644 patches/dropbear-2026.92/series
diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
new file mode 100644
index 000000000..d12d292d2
--- /dev/null
+++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
@@ -0,0 +1,109 @@
+From: Alexander Dahl <ada@thorsis.com>
+Date: Wed, 8 Jul 2026 13:02:37 +0200
+Subject: [PATCH] configure: Fix (deprecated) plugin option
+
+Actually two issues here.
+
+On one hand there was the incomplete rename from --enable-plugin to
+--enable-plugin-deprecated triggering new warnings with
+dropbear-2026.92. Technically new options where ignored while the old
+--enable-plugin and --disable-plugin where still considered.
+
+On the other hand the previous option was broken from the beginning,
+because when passing --enable-plugin or --disable-plugin explicitly the
+option was not evaluated correctly.
+
+Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
+Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
+Fixes: #298
+Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
+Signed-off-by: Alexander Dahl <ada@thorsis.com>
+Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
+---
+ configure | 23 +++++++++++++++++------
+ configure.ac | 15 +++++++++++----
+ 2 files changed, 28 insertions(+), 10 deletions(-)
+
+diff --git a/configure b/configure
+index b8e90be06083..9b7b9b56f6f4 100755
+--- a/configure
++++ b/configure
+@@ -736,7 +736,7 @@ enable_pam
+ enable_openpty
+ enable_syslog
+ enable_shadow
+-enable_plugin
++enable_plugin_deprecated
+ enable_fuzz
+ enable_bundled_libtom
+ enable_lastlog
+@@ -5838,22 +5838,33 @@ fi
+
+
+ # Plugin support will be removed soon. Open a github issue if you're using it.
+-# Check whether --enable-plugin was given.
+-if test ${enable_plugin+y}
++# Check whether --enable-plugin-deprecated was given.
++if test ${enable_plugin_deprecated+y}
+ then :
+- enableval=$enable_plugin;
++ enableval=$enable_plugin_deprecated;
++ if test "x$enableval" = "xyes"; then
+
+ printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
+
+- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
+ printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
+- DROPBEAR_PLUGIN=1
++ DROPBEAR_PLUGIN=1
++ else
++
++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
++
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
++ DROPBEAR_PLUGIN=0
++ fi
+
+ else $as_nop
+
+
+ printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
+
++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
+ DROPBEAR_PLUGIN=0
+
+
+diff --git a/configure.ac b/configure.ac
+index 25a13ee78e88..6dfeacf1f57f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
+ )
+
+ # Plugin support will be removed soon. Open a github issue if you're using it.
+-AC_ARG_ENABLE(plugin,
++AC_ARG_ENABLE(plugin-deprecated,
+ [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
+ [
+- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
+- AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
+- DROPBEAR_PLUGIN=1
++ if test "x$enableval" = "xyes"; then
++ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
++ AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
++ DROPBEAR_PLUGIN=1
++ else
++ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
++ DROPBEAR_PLUGIN=0
++ fi
+ ],
+ [
+ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
+ DROPBEAR_PLUGIN=0
+ ]
+
diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
new file mode 100644
index 000000000..b8f33b5c2
--- /dev/null
+++ b/patches/dropbear-2026.92/series
@@ -0,0 +1,4 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-configure-Fix-deprecated-plugin-option.patch
+# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic
diff --git a/rules/dropbear.make b/rules/dropbear.make
index bc93b0047..3dded0d5b 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
#
# Paths and names
#
-DROPBEAR_VERSION := 2026.91
-DROPBEAR_SHA256 := defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34
+DROPBEAR_VERSION := 2026.92
+DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
DROPBEAR := dropbear-$(DROPBEAR_VERSION)
DROPBEAR_SUFFIX := tar.bz2
DROPBEAR_URL := \
@@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT := \
--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \
--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \
--enable-shadow \
- --disable-plugin \
+ --disable-plugin-deprecated \
--disable-fuzz \
--enable-bundled-libtom \
--$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \
base-commit: ad8c2c3283df6fc624b7dfeb83a0449e2f4b92ed
--
2.47.3
reply other threads:[~2026-07-08 11:47 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260708114733.3505462-1-ada@thorsis.com \
--to=ptxdist@pengutronix.de \
--cc=ada@thorsis.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox