Diffusion FreeBSD ports repository 4ccdf20f1453

security/dropbear: update to 2026.94
4ccdf20f1453
Actions

Description

security/dropbear: update to 2026.94

PR: 297038
Changelog:
2026.94 - 23 July 2026

Note >> for compatibility/configuration changes

Fix scp build failure regression from 2026.93 The new ascii_isdigit() etc wasn't linked.

>> Print square brackets around ipv6 addresses with ports, eg [2a00:f10:400:2:1c00:bcff:fe00:1c6]:22 This may affect log parsers such as fail2ban. Patch from Seo Suchan

Support longer paths in scp.

Avoid some build warnings, add increase github action coverage of config options.

2026.93 - 21 July 2026

Note >> for compatibility/configuration changes

Security: Fix a use-after-free in X11 forwarding that could possibly lead to memory corruption. This is vulnerable to authenticated users if X11 forwarding is enabled. By default X11 forwarding is not built. In 2026.89 the server is running as the authenticated user for X11 forwarding, in earlier versions it runs as root. This removes X11 "single connection" which has probably never been used. Reported by @peter-pe https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4

>> "permitlisten" authorized_keys lines will now be ignored if the port is invalid (>65535). From Basavaraj S Maneppagol.

>> In 2026.92, the configure option --enable-plugin-deprecated wasn't correctly renamed. This is now implemented. Patch from Alexander Dahl

Two factor auth "-t" is no longer deprecated, it will be kept. The "DEPRECATED_TWO_FACTOR" option is ignored, and no longer required.

Fix out of bounds read during utmp/wtmp log file handling, reported by Basavaraj S Maneppagol.

More robust handling of ascii inputs for some platforms. From Basavaraj S Maneppagol

Convert manpages to mdoc format, from shrub

2026.92 - 6 July 2026

Note >> for compatibility/configuration changes

>> server auth plugins have been deprecated, the configure option has been renamed to --enable-plugin-deprecated. Planned to be removed in future.

>> Two factor auth "-t" has been deprecated, it now requires a configuration option DEPRECATED_TWO_FACTOR. [Updated 16 July: This is no longer planned to be removed, future releases will ignore DEPRECATED_TWO_FACTOR and always enable it, like previously]

Security: server: Don't allow -B (accept blank password) with -t (two factor auth). If run with -t and -B a user configured with a blank password would be allowed to log in without pubkey auth. https://github.com/mkj/dropbear/commit/23ec78285639edf068d86bb96f91cba755039740 Reported by nvidia

Security: server: Fix parsing of long authorized_keys lines. The remainder of a long line would be handled as the start of a new line. In the case where external programs add semi-trusted public keys to authorized_keys, a crafted key might bypass restrictions such as "command=". https://github.com/mkj/dropbear/commit/8d8e1930b866eb44135ae393a793cbeb03b6b9d6 Reported by nvidia

>> authorized_keys is now limited to 300 lines.

server: Prevent unbounded memory use that could be triggered by an authenticated peer. This would require waiting for the server to trigger a rekey, so after 8 hours or transferring 1GB data. Noticed while implementing Sunset SSH, also reported by nvidia

>> all programs and scp: Disallow following symlinks when writing output files. This could prevent symlink attacks. Writing keys to an untrusted directory is not recommended regardless.

server: "-o gatewayports=no" was treated as yes.

server: Disallow -t multifactor with plugins. Plugin interactions with -t are not well tested, plugins may not correctly handle multiple successful authentications. Reported by nvidia

server: ensure that authorized_keys "permitopen" values are valid ports. 0xffffffff (or signed equivalent) would be accepted as "any port".

server: fix null pointer segfault when rejecting a stream forward. Found by oss-fuzz

dropbearconvert: Fix out of bounds read. dropbearconvert would exit normally with an error, does not seem exploitable. Reported by Yiyi Wang, Tsinghua University

dbclient: Fixed a 1 byte out of bounds write in ssh-askpass handling (not compiled by default)

server: Increase pubkey query count. The limit added in Dropbear 2026.90 was intended to be 15, but it was only 10. Reported by Rui Salvaterra

scp: escape terminal control codes from filenames printed by progress (SCPPROGRESS=1, disabled by default). Additional fix from Basavaraj S Maneppagol @basavaraj-sm05

Fix sntrup/mlkem build on old platforms using debian/ directory packaging. Note that this isn't well maintained, it is better to use upstream Debian packaging if possible.

Fix compile warning on 32 bit platforms in sntrup

Suggest libcrypt-dev for crypt() in configure script if it's missing.

Increase MAX_HOSTKEYS to 6, suggested by Darren Tucker.

Allow DROPBEAR_ECC_256/384/521 to be specified in localoptions.h Patch from Felipe Moura

Fix typo in missing hostname message, from Robin Neatherway

2026.91 - 10 May 2026

scp: Fix disallowing -r with existing target directory. The logic introduced in 2026.90 was incorrect, could also disallow non-recursive transfers.

scp: Fix regression in 2026.90 building on older glibc or other libc. reallocarray() was required, it is no longer needed.

Compression is now disabled by default for dbclient. A new -o compression option can enable it. DROPBEAR_CLI_COMPRESSION in localoptions.h can change the default. Enabling compression can be a security weakness in some circumstances, as the size of network traffic may leak information about the encrypted data.

Added '-Q' argument for dbclient and dropbear to query supported algorithms, kex sig cipher mac compress

2026.90 - 3 May 2026

Security: server: Fix ability to bypass an authorized_keys "forced_command" option by an authenticated user, if Dropbear is running with "-t" option. ("-t" is require both password and public key). https://github.com/mkj/dropbear/commit/c60db6408178aaca0a8aacd017ac344a2cfb30c8 Reported by Jeremy Brown

Security: server: Open authorized_keys non-blocking. This avoids getting stuck with special files, could allow denial of service from local users. https://github.com/mkj/dropbear/commit/8b579571b5584847caf72345b9073b3b2a0467a7 Reported by Turistu

Security: scp: Add missed patch to fix CVE-2019-6111 allowing a malicious server to overwrite unexpected files. https://github.com/mkj/dropbear/commit/143291baca6ebb3407a0c25c85bd53bf041a6ab7 Patch from OpenSSH, reported missing by Asim Viladi Oglu Manizada @manizada

Note breaking change: "-r" is now disallowed when the target directory exists (an additional change in Dropbear's version). If that's required an alternative such as rsync could be used. https://github.com/mkj/dropbear/commit/61bd0e3e6573277de17359763aa5827a189c8d7f

Security: scp: Clear setuid/setgid bits on received files. https://github.com/mkj/dropbear/commit/443ccc1fd1b9a4e3747f6b5cd644b7af49064308 Patch from OpenSSH, tracked as CVE-2026-35385

Security: client/server: Fix close() of a file descriptor from an out-of-bounds read. This seems difficult to exploit but may have unforeseen effects. https://github.com/mkj/dropbear/commit/067fd3846c425d1998c7c94d3feafe1f26b514eb Reported by Ankit Singh and @j499261162

server: Add unix stream forwarding listener support (-R from the client) Patch from Brian Dentino @bdentino

server: Add -M argument for maximum session duration. Github PR #409 from Martin Schiller

server: Add permitlisten authorized_keys option This allows limiting to a specific port. Github PR #384 from Mitar

rsa: keys generated with dropbearkey 0.32 or earlier are no longer supported, 0.33 was released in 2003. RSA exponent blinding is implemented to reduce a cache timing side channel. Side channel reported by Ciaran Mullan.

server: Limit the number of public key queries to 15. This is a mitigation against internet-wide scanning of hosts for public keys. It doesn't provide much mitigation against targeted enumeration on a server, in that case public keys should not be treated as private. Reported by HD Moore, details are in the SSHamble presentation.

server: Disallow client-sent signals when there is a forced command. Some programs could have unexpected handling. Reported by HD Moore in SSHamble presentation.