buildroot/package/dropbear/dropbear.hash, branch 2017.08

dropbear: security bump to version 2017.75

2017-05-21T21:32:16+00:00

Fixes: - CVE-2017-9078: A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. - CVE-2017-9079: Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys. A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn't normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this. Signed-off-by: Peter Korsgaard

dropbear: bump version to 2016.74

2016-07-23T12:41:04+00:00

According to https://matt.ucc.asn.au/dropbear/CHANGES there were some severe security issues fixed. Signed-off-by: Alexander Dahl Acked-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

dropbear: bump to version 2016.73

2016-03-20T13:52:44+00:00

some new runtime options, minor fixes, and fixes for issues found by various code analyze and lintian tools. Signed-off-by: Alexander Dahl Signed-off-by: Thomas Petazzoni

dropbear: security bump to 2016.72

2016-03-10T13:35:55+00:00

2016.72 - 9 March 2016 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks to Damien Miller for a patch. Signed-off-by: Peter Korsgaard

dropbear: bump to version 2015.71

2015-12-03T20:45:27+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

dropbear: bump version to 2015.70

2015-11-26T15:29:55+00:00

Bugfix release, fixes password auth support detection. Signed-off-by: Peter Korsgaard

dropbear: bump to version 2015.69

2015-11-25T22:24:09+00:00

Fixes a port-forwarding regression in 2015.68 Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

dropbear: bump to 2015.68

2015-10-15T20:22:12+00:00

Signed-off-by: Luca Ceresoli Reviewed-by: Vicente Olivert Riera Tested-by: Vicente Olivert Riera Signed-off-by: Peter Korsgaard

dropbear: bump to version 2015.67

2015-01-28T20:48:02+00:00

Switch sed options around since defaults have changed. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

dropbear: bump to version 2014.66

2014-10-23T20:09:26+00:00

And add hash file. Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni