Mercurial > dropbear

comparison CHANGES @ 1737:8b27de2c92ee

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Change secure.ucc.asn.au/hg to hg.ucc.asn.au
author Matt Johnston <matt@ucc.asn.au>
date Tue, 28 Jul 2020 18:53:48 +0800
parents cddc90de1b6f
children 4b984c42372d
comparison
equal deleted inserted replaced
1736:0c31aedc3124 1737:8b27de2c92ee
213 - Security: Fix double-free in server TCP listener cleanup 213 - Security: Fix double-free in server TCP listener cleanup
214 A double-free in the server could be triggered by an authenticated user if 214 A double-free in the server could be triggered by an authenticated user if
215 dropbear is running with -a (Allow connections to forwarded ports from any host) 215 dropbear is running with -a (Allow connections to forwarded ports from any host)
216 This could potentially allow arbitrary code execution as root by an authenticated user. 216 This could potentially allow arbitrary code execution as root by an authenticated user.
217 Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash. 217 Affects versions 2013.56 to 2016.74. Thanks to Mark Shepard for reporting the crash.
218 CVE-2017-9078 https://secure.ucc.asn.au/hg/dropbear/rev/c8114a48837c 218 CVE-2017-9078 https://hg.ucc.asn.au/dropbear/rev/c8114a48837c
219 219
220 - Security: Fix information disclosure with ~/.ssh/authorized_keys symlink. 220 - Security: Fix information disclosure with ~/.ssh/authorized_keys symlink.
221 Dropbear parsed authorized_keys as root, even if it were a symlink. The fix 221 Dropbear parsed authorized_keys as root, even if it were a symlink. The fix
222 is to switch to user permissions when opening authorized_keys 222 is to switch to user permissions when opening authorized_keys
223 223
225 couldn't normally read. If they managed to get that file to contain valid 225 couldn't normally read. If they managed to get that file to contain valid
226 authorized_keys with command= options it might be possible to read other 226 authorized_keys with command= options it might be possible to read other
227 contents of that file. 227 contents of that file.
228 This information disclosure is to an already authenticated user. 228 This information disclosure is to an already authenticated user.
229 Thanks to Jann Horn of Google Project Zero for reporting this. 229 Thanks to Jann Horn of Google Project Zero for reporting this.
230 CVE-2017-9079 https://secure.ucc.asn.au/hg/dropbear/rev/0d889b068123 230 CVE-2017-9079 https://hg.ucc.asn.au/dropbear/rev/0d889b068123
231 231
232 - Generate hostkeys with dropbearkey atomically and flush to disk with fsync 232 - Generate hostkeys with dropbearkey atomically and flush to disk with fsync
233 Thanks to Andrei Gherzan for a patch 233 Thanks to Andrei Gherzan for a patch
234 234
235 - Fix out of tree builds with bundled libtom 235 - Fix out of tree builds with bundled libtom
245 245
246 A dbclient user who can control username or host arguments could potentially 246 A dbclient user who can control username or host arguments could potentially
247 run arbitrary code as the dbclient user. This could be a problem if scripts 247 run arbitrary code as the dbclient user. This could be a problem if scripts
248 or webpages pass untrusted input to the dbclient program. 248 or webpages pass untrusted input to the dbclient program.
249 CVE-2016-7406 249 CVE-2016-7406
250 https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb 250 https://hg.ucc.asn.au/dropbear/rev/b66a483f3dcb
251 251
252 - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as 252 - Security: dropbearconvert import of OpenSSH keys could run arbitrary code as
253 the local dropbearconvert user when parsing malicious key files 253 the local dropbearconvert user when parsing malicious key files
254 CVE-2016-7407 254 CVE-2016-7407
255 https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e 255 https://hg.ucc.asn.au/dropbear/rev/34e6127ef02e
256 256
257 - Security: dbclient could run arbitrary code as the local dbclient user if 257 - Security: dbclient could run arbitrary code as the local dbclient user if
258 particular -m or -c arguments are provided. This could be an issue where 258 particular -m or -c arguments are provided. This could be an issue where
259 dbclient is used in scripts. 259 dbclient is used in scripts.
260 CVE-2016-7408 260 CVE-2016-7408
261 https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6 261 https://hg.ucc.asn.au/dropbear/rev/eed9376a4ad6
262 262
263 - Security: dbclient or dropbear server could expose process memory to the 263 - Security: dbclient or dropbear server could expose process memory to the
264 running user if compiled with DEBUG_TRACE and running with -v 264 running user if compiled with DEBUG_TRACE and running with -v
265 CVE-2016-7409 265 CVE-2016-7409
266 https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04 266 https://hg.ucc.asn.au/dropbear/rev/6a14b1f6dc04
267 267
268 The security issues were reported by an anonymous researcher working with 268 The security issues were reported by an anonymous researcher working with
269 Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html 269 Beyond Security's SecuriTeam Secure Disclosure www.beyondsecurity.com/ssd.html
270 270
271 - Fix port forwarding failure when connecting to domains that have both 271 - Fix port forwarding failure when connecting to domains that have both
307 307
308 2016.72 - 9 March 2016 308 2016.72 - 9 March 2016
309 309
310 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions, 310 - Validate X11 forwarding input. Could allow bypass of authorized_keys command= restrictions,
311 found by github.com/tintinweb. Thanks for Damien Miller for a patch. CVE-2016-3116 311 found by github.com/tintinweb. Thanks for Damien Miller for a patch. CVE-2016-3116
312 https://secure.ucc.asn.au/hg/dropbear/rev/a3e8389e01ff 312 https://hg.ucc.asn.au/dropbear/rev/a3e8389e01ff
313 313
314 2015.71 - 3 December 2015 314 2015.71 - 3 December 2015
315 315
316 - Fix "bad buf_incrpos" when data is transferred, broke in 2015.69 316 - Fix "bad buf_incrpos" when data is transferred, broke in 2015.69
317 317
588 Patch from Martin Donnelly 588 Patch from Martin Donnelly
589 589
590 - Limit the size of decompressed payloads, avoids memory exhaustion denial 590 - Limit the size of decompressed payloads, avoids memory exhaustion denial
591 of service 591 of service
592 Thanks to Logan Lamb for reporting and investigating it. CVE-2013-4421 592 Thanks to Logan Lamb for reporting and investigating it. CVE-2013-4421
593 https://secure.ucc.asn.au/hg/dropbear/rev/0bf76f54de6f 593 https://hg.ucc.asn.au/dropbear/rev/0bf76f54de6f
594 594
595 - Avoid disclosing existence of valid users through inconsistent delays 595 - Avoid disclosing existence of valid users through inconsistent delays
596 Thanks to Logan Lamb for reporting. CVE-2013-4434 596 Thanks to Logan Lamb for reporting. CVE-2013-4434
597 https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a 597 https://hg.ucc.asn.au/dropbear/rev/d7784616409a
598 598
599 - Update config.guess and config.sub for newer architectures 599 - Update config.guess and config.sub for newer architectures
600 600
601 - Avoid segfault in server for locked accounts 601 - Avoid segfault in server for locked accounts
602 602
695 authorized_keys restrictions are used. Could allow arbitrary code execution 695 authorized_keys restrictions are used. Could allow arbitrary code execution
696 or bypass of the command="..." restriction to an authenticated user. 696 or bypass of the command="..." restriction to an authenticated user.
697 This bug affects releases 0.52 onwards. Ref CVE-2012-0920. 697 This bug affects releases 0.52 onwards. Ref CVE-2012-0920.
698 Thanks to Danny Fullerton of Mantor Organization for reporting 698 Thanks to Danny Fullerton of Mantor Organization for reporting
699 the bug. 699 the bug.
700 https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749 700 https://hg.ucc.asn.au/dropbear/rev/818108bf7749
701 701
702 - Compile fix, only apply IPV6 socket options if they are available in headers 702 - Compile fix, only apply IPV6 socket options if they are available in headers
703 Thanks to Gustavo Zacarias for the patch 703 Thanks to Gustavo Zacarias for the patch
704 704
705 - Overwrite session key memory on exit 705 - Overwrite session key memory on exit
739 message informing what the port is, thanks to Ali Onur Uyar. 739 message informing what the port is, thanks to Ali Onur Uyar.
740 740
741 - New version numbering scheme. 741 - New version numbering scheme.
742 742
743 Source repository has now migrated to Mercurial at 743 Source repository has now migrated to Mercurial at
744 https://secure.ucc.asn.au/hg/dropbear/graph/default 744 https://hg.ucc.asn.au/dropbear/graph/default
745 745
746 0.53.1 - Wednesday 2 March 2011 746 0.53.1 - Wednesday 2 March 2011
747 747
748 - -lcrypt needs to be before object files for static linking 748 - -lcrypt needs to be before object files for static linking
749 749