Hauke Mehrtens f75c726430 dropbear: backport some security fixes from 2026.90 ... This cherry picks the following changes: - Security: server: Fix ability to bypass an authorized_keys "forced_command" option by an authenticated user, if Dropbear is running with "-t" option. ("-t" is require both password and public key). c60db64081 Reported by Jeremy Brown - Security: server: Open authorized_keys non-blocking. This avoids getting stuck with special files, could allow denial of service from local users. 8b579571b5 Reported by Turistu - Security: scp: Add missed patch to fix CVE-2019-6111 allowing a malicious server to overwrite unexpected files. 143291baca Patch from OpenSSH, reported missing by Asim Viladi Oglu Manizada @manizada Note breaking change: "-r" is now disallowed when the target directory exists (an additional change in Dropbear's version). If that's required an alternative such as rsync could be used. 61bd0e3e65 - Security: scp: Clear setuid/setgid bits on received files. 443ccc1fd1 Patch from OpenSSH, tracked as CVE-2026-35385 - Security: client/server: Fix close() of a file descriptor from an out-of-bounds read. This seems difficult to exploit but may have unforeseen effects. 067fd3846c Reported by Ankit Singh and @j499261162 Link: https://github.com/openwrt/openwrt/pull/23980 (cherry picked from commit 2218cb19494609076776ae8c13254de60c5f40f3) Link: https://github.com/openwrt/openwrt/pull/24296 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 262c09368fda76c85c519b7554f33bb98fb3263f)		2026-08-18 11:40:42 +01:00
..
files	dropbear: enable configurable port forwarding options	2026-07-09 10:57:35 +01:00
patches	dropbear: backport some security fixes from 2026.90	2026-08-18 11:40:42 +01:00
Config.in
Makefile	dropbear: backport some security fixes from 2026.90	2026-08-18 11:40:42 +01:00