From: Alexander Dahl via ptxdist <ptxdist@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: Alexander Dahl <ada@thorsis.com>
Subject: [ptxdist] [PATCH] dropbear: version bump 2026.92 -> 2026.94
Date: Mon, 3 Aug 2026 14:15:38 +0200 [thread overview]
Message-ID: <20260803121538.111425-1-ada@thorsis.com> (raw)
2026.93 with one security fix, some minor hardening,
and the configuration patch gone upstream:
- Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4
2026.94 fixing a build regression introduced in 2026.93 and some minor
improvements.
Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.93
Link: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.94
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
...nfigure-Fix-deprecated-plugin-option.patch | 109 ------------------
patches/dropbear-2026.92/series | 4 -
rules/dropbear.make | 4 +-
3 files changed, 2 insertions(+), 115 deletions(-)
delete mode 100644 patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
delete mode 100644 patches/dropbear-2026.92/series
diff --git a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch b/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
deleted file mode 100644
index d12d292d2..000000000
--- a/patches/dropbear-2026.92/0001-configure-Fix-deprecated-plugin-option.patch
+++ /dev/null
@@ -1,109 +0,0 @@
-From: Alexander Dahl <ada@thorsis.com>
-Date: Wed, 8 Jul 2026 13:02:37 +0200
-Subject: [PATCH] configure: Fix (deprecated) plugin option
-
-Actually two issues here.
-
-On one hand there was the incomplete rename from --enable-plugin to
---enable-plugin-deprecated triggering new warnings with
-dropbear-2026.92. Technically new options where ignored while the old
---enable-plugin and --disable-plugin where still considered.
-
-On the other hand the previous option was broken from the beginning,
-because when passing --enable-plugin or --disable-plugin explicitly the
-option was not evaluated correctly.
-
-Link: https://www.gnu.org/software/autoconf/manual/autoconf-2.71/html_node/Package-Options.html
-Fixes: 8c6aaf8d361e ("External Public-Key Authentication API (#72)")
-Fixes: #298
-Fixes: e3e7b28c33ac ("Make -t two factor and plugins deprecated")
-Signed-off-by: Alexander Dahl <ada@thorsis.com>
-Upstream-Status: Submitted [https://github.com/mkj/dropbear/pull/462]
----
- configure | 23 +++++++++++++++++------
- configure.ac | 15 +++++++++++----
- 2 files changed, 28 insertions(+), 10 deletions(-)
-
-diff --git a/configure b/configure
-index b8e90be06083..9b7b9b56f6f4 100755
---- a/configure
-+++ b/configure
-@@ -736,7 +736,7 @@ enable_pam
- enable_openpty
- enable_syslog
- enable_shadow
--enable_plugin
-+enable_plugin_deprecated
- enable_fuzz
- enable_bundled_libtom
- enable_lastlog
-@@ -5838,22 +5838,33 @@ fi
-
-
- # Plugin support will be removed soon. Open a github issue if you're using it.
--# Check whether --enable-plugin was given.
--if test ${enable_plugin+y}
-+# Check whether --enable-plugin-deprecated was given.
-+if test ${enable_plugin_deprecated+y}
- then :
-- enableval=$enable_plugin;
-+ enableval=$enable_plugin_deprecated;
-+ if test "x$enableval" = "xyes"; then
-
- printf "%s\n" "#define DROPBEAR_PLUGIN 1" >>confdefs.h
-
-- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
-+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Enabling support for External Public Key Authentication" >&5
- printf "%s\n" "$as_me: Enabling support for External Public Key Authentication" >&6;}
-- DROPBEAR_PLUGIN=1
-+ DROPBEAR_PLUGIN=1
-+ else
-+
-+printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
-+
-+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
-+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
-+ DROPBEAR_PLUGIN=0
-+ fi
-
- else $as_nop
-
-
- printf "%s\n" "#define DROPBEAR_PLUGIN 0" >>confdefs.h
-
-+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: Disabling support for External Public Key Authentication" >&5
-+printf "%s\n" "$as_me: Disabling support for External Public Key Authentication" >&6;}
- DROPBEAR_PLUGIN=0
-
-
-diff --git a/configure.ac b/configure.ac
-index 25a13ee78e88..6dfeacf1f57f 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -345,15 +345,22 @@ AC_ARG_ENABLE(shadow,
- )
-
- # Plugin support will be removed soon. Open a github issue if you're using it.
--AC_ARG_ENABLE(plugin,
-+AC_ARG_ENABLE(plugin-deprecated,
- [AS_HELP_STRING([--enable-plugin-deprecated], [Enable support for External Public Key Authentication plug-in])],
- [
-- AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
-- AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
-- DROPBEAR_PLUGIN=1
-+ if test "x$enableval" = "xyes"; then
-+ AC_DEFINE(DROPBEAR_PLUGIN, 1, External Public Key Authentication)
-+ AC_MSG_NOTICE(Enabling support for External Public Key Authentication)
-+ DROPBEAR_PLUGIN=1
-+ else
-+ AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
-+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
-+ DROPBEAR_PLUGIN=0
-+ fi
- ],
- [
- AC_DEFINE(DROPBEAR_PLUGIN, 0, External Public Key Authentication)
-+ AC_MSG_NOTICE(Disabling support for External Public Key Authentication)
- DROPBEAR_PLUGIN=0
- ]
-
diff --git a/patches/dropbear-2026.92/series b/patches/dropbear-2026.92/series
deleted file mode 100644
index b8f33b5c2..000000000
--- a/patches/dropbear-2026.92/series
+++ /dev/null
@@ -1,4 +0,0 @@
-# generated by git-ptx-patches
-#tag:base --start-number 1
-0001-configure-Fix-deprecated-plugin-option.patch
-# 5e7edc37cce39b1dd92d69f9a2cf364c - git-ptx-patches magic
diff --git a/rules/dropbear.make b/rules/dropbear.make
index 3dded0d5b..eb720532d 100644
--- a/rules/dropbear.make
+++ b/rules/dropbear.make
@@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear
#
# Paths and names
#
-DROPBEAR_VERSION := 2026.92
-DROPBEAR_SHA256 := 91dcb5234de8dea68dd82c55411c9fc986b457ab58372a780ee8a870419c2f7e
+DROPBEAR_VERSION := 2026.94
+DROPBEAR_SHA256 := e098034a843699200c8c977a991fff73159735bf795d5f72ef672c41a6b1ae81
DROPBEAR := dropbear-$(DROPBEAR_VERSION)
DROPBEAR_SUFFIX := tar.bz2
DROPBEAR_URL := \
base-commit: fccbfeb4cf9fbf8a6e53d5deb5fc45d9de70aaff
--
2.47.3
reply other threads:[~2026-08-03 12:16 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260803121538.111425-1-ada@thorsis.com \
--to=ptxdist@pengutronix.de \
--cc=ada@thorsis.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox