Publishing details

• Published on 2024-02-10

Changelog

dropbear (2020.81-3+deb11u1) bullseye; urgency=medium

  * Fix CVE-2021-36369: Due to a non-RFC-compliant check of the available
    authentication methods in the client-side SSH code, it is possible for an
    SSH server to change the login process in its favor.
  * Fix CVE-2023-48795 (terrapin attack): The SSH transport protocol with
    certain OpenSSH extensions allows remote attackers to bypass integrity
    checks such that some packets are omitted (from the extension negotiation
    message), and a client and server may consequently end up with a
    connection for which some security features have been downgraded or
    disabled, aka a Terrapin attack. (Closes: #1059001)
  * d/t/on-lvm-and-luks: Target bullseye not sid.
  * d/t/on-lvm-and-luks: Bump disk image size to 4G as the previous size was
    too small for bullseye-security updates (kernel etc.).
  * Salsa CI: Target bullseye and disable lintian job.

 -- Guilhem Moulin <email address hidden>  Fri, 26 Jan 2024 12:00:26 +0100

Builds

Package files

• dropbear_2020.81-3+deb11u1.debian.tar.xz (34.1 KiB)
• dropbear_2020.81-3+deb11u1.dsc (2.5 KiB)
• dropbear_2020.81.orig.tar.bz2 (2.2 MiB)
• dropbear_2020.81.orig.tar.bz2.asc (833 bytes)