From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 15 Jul 2026 12:02:24 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wjwRc-00407D-1N for lore@lore.pengutronix.de; Wed, 15 Jul 2026 12:02:24 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wjwRU-0006sJ-GP; Wed, 15 Jul 2026 12:02:16 +0200 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wjwRA-0005tx-2V for ptxdist@pengutronix.de; Wed, 15 Jul 2026 12:01:56 +0200 Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 09B85202235; Wed, 15 Jul 2026 12:01:51 +0200 (CEST) Received: from dude05.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::54]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wjwR4-001uoB-30; Wed, 15 Jul 2026 12:01:50 +0200 Received: from mol by dude05.red.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1wjwR4-00000005GZ1-3gUu; Wed, 15 Jul 2026 12:01:50 +0200 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Wed, 15 Jul 2026 12:01:50 +0200 Message-ID: <20260715100150.1255304-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260708114733.3505462-1-ada@thorsis.com> References: <20260708114733.3505462-1-ada@thorsis.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] dropbear: version bump 2026.91 -> 2026.92 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 70fff79697d92205e1d47478bc76186dc4584bbd. Michael [sent from post-receive hook] On Wed, 15 Jul 2026 12:01:50 +0200, Alexander Dahl wrote: > Two security fixes. Adding a patch for a build issue. > > Noteworthy compatibility/configuration changes from the changelog: > > - >> server auth plugins have been deprecated, the configure option > has been renamed to --enable-plugin-deprecated. > Planned to be removed in future. > > - >> Two factor auth "-t" has been deprecated, it now requires > a configuration option DEPRECATED_TWO_FACTOR. > Planned to be removed in future. > > - Security: server: Don't allow -B (accept blank password) with > -t (two factor auth). If run with -t and -B a user configured with a > blank password would be allowed to log in without pubkey auth. > https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740 > Reported by nvidia > > - Security: server: Fix parsing of long authorized_keys lines. > The remainder of a long line would be handled as the start of a new line. > In the case where external programs add semi-trusted public keys to > authorized_keys, a crafted key might bypass restrictions such as "command=". > https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6 > Reported by nvidia > > - >> authorized_keys is now limited to 300 lines. > > - >> all programs and scp: Disallow following symlinks when writing output > files. This could prevent symlink attacks. Writing keys to an untrusted > directory is not recommended regardless. > > Signed-off-by: Alexander Dahl > Message-Id: <20260708114733.3505462-1-ada@thorsis.com> > Signed-off-by: Michael Olbrich > > diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch > new file mode 100644 > index 000000000000..d12d292d273c > --- /dev/null > +++ b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch > @@ -0,0 +1,109 @@ > +From: Alexander Dahl > +Date: Wed, 8 Jul 2026 13:02:37 +0200 > +Subject: [PATCH] configure: Fix (deprecated) plugin option > + > +Actually two issues here. > + > +On one hand there was the incomplete rename from --enable-plugin to > +--enable-plugin-deprecated triggering new warnings with > +dropbear-2026.92. Technically new options where ignored while the old > +--enable-plugin and --disable-plugin where still considered. > + > +On the other hand the previous option was broken from the beginning, > +because when passing --enable-plugin or --disable-plugin explicitly the > +option was not evaluated correctly. > + > +Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html > +Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)") > +Fixes: #298 > +Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated") > +Signed-off-by: Alexander Dahl > +Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462] > +--- > + configure | 23 +++++++++++++++++------ > + configure.ac | 15 +++++++++++---- > + 2 files changed, 28 insertions(+), 10 deletions(-) > + > +diff --git a/configure b/configure > +index b8e90be06083..9b7b9b56f6f4 100755 > +--- a/configure > ++++ b/configure > +@@ -736,7 +736,7 @@ enable_pam > + enable_openpty > + enable_syslog > + enable_shadow > +-enable_plugin > ++enable_plugin_deprecated > + enable_fuzz > + enable_bundled_libtom > + enable_lastlog > +@@ -5838,22 +5838,33 @@ fi > + > + > + # Plugin support will be removed soon. Open a github issue if you're using it. > +-# Check whether --enable-plugin was given. > +-if test ${enable_plugin+y} > ++# Check whether --enable-plugin-deprecated was given. > ++if test ${enable_plugin_deprecated+y} > + then : > +- enableval=$enable_plugin; > ++ enableval=$enable_plugin_deprecated; > ++ if test "x$enableval" = "xyes"; then > + > + printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h > + > +- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 > ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5 > + printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;} > +- DROPBEAR_PLUGIN=1 > ++ DROPBEAR_PLUGIN=1 > ++ else > ++ > ++printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h > ++ > ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 > ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} > ++ DROPBEAR_PLUGIN=0 > ++ fi > + > + else $as_nop > + > + > + printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h > + > ++ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5 > ++printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;} > + DROPBEAR_PLUGIN=0 > + > + > +diff --git a/configure.ac b/configure.ac > +index 25a13ee78e88..6dfeacf1f57f 100644 > +--- a/configure.ac > ++++ b/configure.ac > +@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow, > + ) > + > + # Plugin support will be removed soon. Open a github issue if you're using it. > +-AC_ARG_ENABLE(plugin, > ++AC_ARG_ENABLE(plugin-deprecated, > + [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])], > + [ > +- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) > +- AC_MSG_NOTICE(Enabling support for External Public Key Authentication) > +- DROPBEAR_PLUGIN=1 > ++ if test "x$enableval" = "xyes"; then > ++ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication) > ++ AC_MSG_NOTICE(Enabling support for External Public Key Authentication) > ++ DROPBEAR_PLUGIN=1 > ++ else > ++ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) > ++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) > ++ DROPBEAR_PLUGIN=0 > ++ fi > + ], > + [ > + AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication) > ++ AC_MSG_NOTICE(Disabling support for External Public Key Authentication) > + DROPBEAR_PLUGIN=0 > + ] > + > diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series > new file mode 100644 > index 000000000000..b8f33b5c25c1 > --- /dev/null > +++ b/patches/dropbear-2026.92/series > @@ -0,0 +1,4 @@ > +# generated by git-ptx-patches > +#tag:base --start-number 1 > +0001-configure-Fix-deprecated-plugin-option.patch > +# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic > diff --git a/rules/dropbear.make b/rules/dropbear.make > index bc93b0047a40..3dded0d5b3a6 100644 > --- a/rules/dropbear.make > +++ b/rules/dropbear.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear > # > # Paths and names > # > -DROPBEAR_VERSION := 2026.91 > -DROPBEAR_SHA256 := defa924475abf6bc1e74abc00173e46bfdc804bd47caafa14f5a4ef0cc76da34 > +DROPBEAR_VERSION := 2026.92 > +DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e > DROPBEAR := dropbear-$(DROPBEAR_VERSION) > DROPBEAR_SUFFIX := tar.bz2 > DROPBEAR_URL := \ > @@ -52,7 +52,7 @@ DROPBEAR_CONF_OPT := \ > --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_OPENPTY)-openpty \ > --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_SYSLOG)-syslog \ > --enable-shadow \ > - --disable-plugin \ > + --disable-plugin-deprecated \ > --disable-fuzz \ > --enable-bundled-libtom \ > --$(call ptx/disen, PTXCONF_DROPBEAR_DIS_LASTLOG)-lastlog \