Changelog
dropbear (2020.81-3+deb11u1) bullseye; urgency=medium
* Fix CVE-2021-36369: Due to a non-RFC-compliant check of the available
authentication methods in the client-side SSH code, it is possible for an
SSH server to change the login process in its favor.
* Fix CVE-2023-48795 (terrapin attack): The SSH transport protocol with
certain OpenSSH extensions allows remote attackers to bypass integrity
checks such that some packets are omitted (from the extension negotiation
message), and a client and server may consequently end up with a
connection for which some security features have been downgraded or
disabled, aka a Terrapin attack. (Closes: #1059001)
* d/t/on-lvm-and-luks: Target bullseye not sid.
* d/t/on-lvm-and-luks: Bump disk image size to 4G as the previous size was
too small for bullseye-security updates (kernel etc.).
* Salsa CI: Target bullseye and disable lintian job.
-- Guilhem Moulin <email address hidden> Fri, 26 Jan 2024 12:00:26 +0100
