The release of the Dropbear project 2026.90 has been published, which develops an SSH server and client that is widely used in wireless routers and compact distributions like OpenWrt. Dropbear is characterized by low memory consumption, the ability to disable unnecessary functionality at compile time, and support for combining the client and server into a single executable file, similar to busybox. When statically linked with uClibc, the Dropbear executable file occupies only 110kB. Dropbear supports X11 forwarding, is compatible with the OpenSSH key file (~/.ssh/authorized_keys), and can establish multiplexed connections with forwarding through a transit host. The project code is written in C and is distributed under a license similar to MIT.
The new version fixes several security issues:
- Incomplete mitigation of the scp vulnerability (CVE-2019-6111), which allows overwriting other files when connecting to a malicious host. server. When using scp, server the decision on which files and directories to send to the client is made on the server side, while the client only verifies the correctness of the returned object names. The client-side check prevents escaping the current directory ("../"), but in the case of recursive copying (-r), it does not consider cases of transferring directories with names different from those originally requested. The issue has been resolved by prohibiting the use of the "-r" option with an already existing target directory.
- A vulnerability (CVE-2026-35385) in the scp utility, which, when downloading a file with root privileges using the "-O" option and without the "-p" option, did not clear setuid/setgid flags.
- The ability to bypass the execution of the "forced_command" in the authorized_keys settings when connecting an authenticated user using the "-t" option (login with password and public key verification).
- Denial of service due to the creation by a local user of a special file named authorized_keys, blocking read operations.
- Reading data from outside the buffer when creating handlers for forwarding client and server requests, which may lead to the closure of arbitrary file descriptors.
Non-security related changes:
- An option "-R" has been added to ssh for forwarding unix sockets through an SSH tunnel.
- An option "-M" has been added to ssd to limit the maximum duration of the session.
- An option "permitlisten" has been added to "authorized_keys" to restrict acceptable ports.
- Support for RSA keys generated with dropbearkey 0.32 or earlier versions of this utility has been discontinued due to susceptibility to side-channel attacks that assess the timing differences of cached and uncached data.
- To block brute force attempts on open keys on hosts, the number of open key requests is limited to 15 attempts for each session.
Source: opennet.ru
