buildroot/package/dropbear, branch 2017.11.2

dropbear: security bump to version 2017.75

2017-05-21T21:32:16+00:00

Fixes: - CVE-2017-9078: A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (Allow connections to forwarded ports from any host) This could potentially allow arbitrary code execution as root by an authenticated user. Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. - CVE-2017-9079: Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys. A user could symlink their ~/.ssh/authorized_keys to a root-owned file they couldn't normally read. If they managed to get that file to contain valid authorized_keys with command= options it might be possible to read other contents of that file. This information disclosure is to an already authenticated user. Thanks to Jann Horn of Google Project Zero for reporting this. Signed-off-by: Peter Korsgaard

boot, package: use SPDX short identifier for BSD-2c

2017-04-01T13:27:05+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-2c is BSD-2-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-2c/BSD-2-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

dropbear: bump version to 2016.74

2016-07-23T12:41:04+00:00

According to https://matt.ucc.asn.au/dropbear/CHANGES there were some severe security issues fixed. Signed-off-by: Alexander Dahl Acked-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

dropbear: bump to version 2016.73

2016-03-20T13:52:44+00:00

some new runtime options, minor fixes, and fixes for issues found by various code analyze and lintian tools. Signed-off-by: Alexander Dahl Signed-off-by: Thomas Petazzoni

dropbear: security bump to 2016.72

2016-03-10T13:35:55+00:00

2016.72 - 9 March 2016 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, found by github.com/tintinweb. Thanks to Damien Miller for a patch. Signed-off-by: Peter Korsgaard

dropbear: add help text about key creation

2016-01-12T22:35:08+00:00

Commit e7d04dd2d replaced /etc/dropbear with a symlink to /var/run and updated the start scripts to replace it with a real directory, so the keys would be persistent. However, it turns out that this is pretty confusing even for expert users, who don't know how to make the keys really persistent now. Update the help text explaining what the issue is, and telling the user to replace the /etc/dropbear symlink with a symlink to a persistent directory. Also mention the possiblity of unionfs. Cc: Thomas De Schampheleire Signed-off-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Peter Korsgaard

dropbear: bump to version 2015.71

2015-12-03T20:45:27+00:00

Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

dropbear: bump version to 2015.70

2015-11-26T15:29:55+00:00

Bugfix release, fixes password auth support detection. Signed-off-by: Peter Korsgaard

dropbear: bump to version 2015.69

2015-11-25T22:24:09+00:00

Fixes a port-forwarding regression in 2015.68 Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

dropbear: dropbear.service: /etc/default/dropbear is optional

2015-11-09T22:11:52+00:00

The environment file is for optional customization, so don't error out if it isn't present. Signed-off-by: Peter Korsgaard