CVS commit: pkgsrc/security/dropbear

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Jul 24 13:11:38 UTC 2025

Modified Files:
        pkgsrc/security/dropbear: Makefile distinfo

Log Message:
dropbear: updated to 2025.88

2025.88

- Security: Don't allow dbclient hostname arguments to be interpreted
  by the shell.

  dbclient hostname arguments with a comma (for multihop) would be
  passed to the shell which could result in running arbitrary shell
  commands locally. That could be a security issue in situations
  where dbclient is passed untrusted hostname arguments.

  Now the multihop command is executed directly, no shell is involved.
  Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203

- Fix compatibility for htole64 and htole32, regression in 2025.87
  Patch from Peter Fichtner to work with old GCC versions, and
  patch from Matt Robinson to check different header files.

- Fix building on older compilers or libc that don't support
  static_assert(). Regression in 2025.87

- Support ~R in the client to force a key re-exchange.

- Improve strict KEX handling. Dropbear previously would allow other
  packets at the end of key exchange prior to receiving the remote
  peer's NEWKEYS message, which should be forbidden by strict KEX.
  Reported by Fabian Bäumer.


To generate a diff of this commit:
cvs rdiff -u -r1.44 -r1.45 pkgsrc/security/dropbear/Makefile
cvs rdiff -u -r1.36 -r1.37 pkgsrc/security/dropbear/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/dropbear/Makefile
diff -u pkgsrc/security/dropbear/Makefile:1.44 pkgsrc/security/dropbear/Makefile:1.45
--- pkgsrc/security/dropbear/Makefile:1.44      Sun May  4 13:17:38 2025
+++ pkgsrc/security/dropbear/Makefile   Thu Jul 24 13:11:37 2025
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.44 2025/05/04 13:17:38 nia Exp $
+# $NetBSD: Makefile,v 1.45 2025/07/24 13:11:37 adam Exp $
 
-DISTNAME=      dropbear-2025.87
-PKGREVISION=   1
+DISTNAME=      dropbear-2025.88
 CATEGORIES=    security
 MASTER_SITES=  https://matt.ucc.asn.au/dropbear/releases/
 EXTRACT_SUFX=  .tar.bz2

Index: pkgsrc/security/dropbear/distinfo
diff -u pkgsrc/security/dropbear/distinfo:1.36 pkgsrc/security/dropbear/distinfo:1.37
--- pkgsrc/security/dropbear/distinfo:1.36      Sun May  4 13:17:38 2025
+++ pkgsrc/security/dropbear/distinfo   Thu Jul 24 13:11:37 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.36 2025/05/04 13:17:38 nia Exp $
+$NetBSD: distinfo,v 1.37 2025/07/24 13:11:37 adam Exp $
 
-BLAKE2s (dropbear-2025.87.tar.bz2) = b31ac4f3febd9eb9bfb981c75fcdc2edb3794d86db0d7d25c3f3614b259c5ac5
-SHA512 (dropbear-2025.87.tar.bz2) = afe30b2c795c21ba76d0e4f7b95d9f61ca0ce31510c5fd5183feef2984b49122ccb600c5eae8ac05d9c3cf6bb6237f760cfcf4f7c546656f555e46e992d1efeb
-Size (dropbear-2025.87.tar.bz2) = 2368085 bytes
+BLAKE2s (dropbear-2025.88.tar.bz2) = 0b61f76f893fefabdf5c2ae14662da42e43aadaa86acd93b1d9112f02de4d921
+SHA512 (dropbear-2025.88.tar.bz2) = 71194f4792287b9e56e07cfa9a3e97d23b7fda82c858e0219d0d54aee48e77892997330ad1af5654a738b970965a92a79468bbf5c8ba0358b046fd053dfc87ed
+Size (dropbear-2025.88.tar.bz2) = 2370480 bytes
 SHA1 (patch-Makefile.in) = 0bb649ed8688666513c35e139e7e349fd83b3a1b
 SHA1 (patch-configure) = b17f647043b212adda53aad7fb8dc7e639be9494
 SHA1 (patch-src_default__options.h) = c0be06f186a4fb07ad0aedc26047f7077847e75a