{"id":170353,"date":"2026-05-04T12:24:42","date_gmt":"2026-05-04T10:24:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej"},"modified":"2026-05-04T12:24:42","modified_gmt":"2026-05-04T10:24:42","slug":"vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej","title":{"rendered":"V\u00e4ljaanne Dropbear SSH 2026.90 haavatavuse k\u00f5rvaldamisega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Avaldatud on Dropbear projekti versioon 2026.90, mis arendab SSH-serverit ja -kliendi rakendust, mida on laialdaselt kasutatud traadita ruuterites ja kompaktsetes distributsioonides nagu OpenWrt. Dropbear eristub madala m\u00e4lutarbimise poolest, v\u00f5imalusest keelduda liigsetest funktsioonidest koostamisprotsessi ajal ning toetab kliendi ja serveri kogumist \u00fchte t\u00e4itmisfaili sarnaselt busyboxiga. Statiilise sidumise korral uClibc-ga on Dropbear'i t\u00e4itmisfaili suurus vaid 110 kB. Dropbear toetab X11 edastamist, on \u00fchilduv OpenSSH v\u00f5tmefailiga (~\/.ssh\/authorized_keys) ning v\u00f5imaldab mitme\u00fchenduste loomist kaudu vahehosti. Projekti kood on kirjutatud C keeles ja jagatakse MIT-l\u00e4hedase litsentsi alusel.      <\/p>\n<p>Uues versioonis on parandatud mitu turvaprobleemi:  <\/p>\n<ul>\n<li class=\"l\"> Ebat\u00e4ielik k\u00f5rvaldamine scp haavatavusest (CVE-2019-6111), mis v\u00f5imaldab teiste failide \u00fclekirjutamist pahatahtliku juurde p\u00e4\u00e4su korral. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-shicago\/\" title=\"serveri\" data-wpil-keyword-link=\"linked\">serveri<\/a>Kasutades scp, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/\"   title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> otsustab, millised failid ja kataloogid kliendile edastada, kliendi \u00fclesanne on vaid kontrollida tagastatud objektide nimede \u00f5igsust. Kliendi poolel tehtav kontroll takistab v\u00e4ljumist praeguse katalooge piirest (&#171;..\\\/&#187;), kuid rekursiivse kopeerimise (-r) puhul ei arvestata olukordi, kus edastatakse katalooge, mille nimed erinevad esialgselt n\u00f5utud nimedest. Probleem lahendati valiku &#171;-r&#187; kasutamise keelamisega juba olemasoleva sihtkatalooge korral.\n<li class=\"l\"> Haavatavus (CVE-2026-35385) utiliidis scp, mille t\u00f5ttu ei kustutatud p\u00e4rast root \u00f5igustega faili \u00fcleslaadimist, kui kasutati valikut &#171;-O&#187; ja ei kasutatud valikut &#171;-p&#187;, setuid\/setgid lippe.\n<li class=\"l\"> V\u00f5imalus v\u00e4ltida k\u00e4su &#171;forced_command&#187; t\u00e4itmist autoriseeritud_kliendifailides connected kasutajana, kes kasutab valikut &#171;-t&#187; (sisse logimine parooli ja avaliku v\u00f5tme kontrolliga).\n<li class=\"l\"> Teenuse katkestamine kohaliku kasutaja loodud spetsiaalfaili kaudu nimega authorized_keys, mis blokeerib lugemisoperatsioonid.\n<li class=\"l\"> Andmete lugemine puhvriv\u00e4lisest piirkonnast kliendi ja serveri p\u00e4ringute suunamise t\u00f6\u00f6tlejate loomisel, mis v\u00f5ib viia suvaliste failikdescriptorite sulgemiseni.    <\/ul>\n<p>Mitte turvalisuse muudatused:  <\/p>\n<ul>\n<li class=\"l\"> ssh-sse on lisatud valik &#171;-R&#187; unix sokettide edastamiseks l\u00e4bi SSH tunnel.\n<li class=\"l\"> ssd-sse on lisatud valik &#171;-M&#187; maksimaalse seansi kestuse piiramiseks.\n<li class=\"l\"> &#171;authorized_keys&#187; on lisatud valik &#171;permitlisten&#187; lubatud portide piiramise jaoks.\n<li class=\"l\"> Dropbearkey 0.32 v\u00f5i varasemate versioonide loodud RSA v\u00f5tmete toetus on l\u00f5petatud. Need v\u00f5tmed on vastuv\u00f5tlikud k\u00fclgkanali r\u00fcnnakutele, mis hindavad t\u00f6\u00f6tlemise ajavahe erinevust andmete puhul, mis on salvestatud vahem\u00e4llu ja mis ei ole.\n<li class=\"l\"> Avatud v\u00f5tmete proovimise v\u00e4ltimiseks on hostide avatud v\u00f5tmete p\u00e4ringute arv piiratud 15 katsega iga seansi jaoks.        <\/ul>\n<p>Allikas: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65356\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Dropbear 2026.90, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 SSH, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0438 \u043a\u043e\u043c\u043f\u0430\u043a\u0442\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445, \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 OpenWrt. Dropbear \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0438\u0437\u043a\u0438\u043c \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043b\u0438\u0448\u043d\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u044d\u0442\u0430\u043f\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 busybox. \u041f\u0440\u0438 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u043d\u0438\u0438 \u0441 uClibc \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b Dropbear \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170353","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Dropbear 2026.90, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 SSH, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0438 \u043a\u043e\u043c\u043f\u0430\u043a\u0442\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445, \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 OpenWrt.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Dropbear SSH 2026.90 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Dropbear 2026.90, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 SSH, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0438 \u043a\u043e\u043c\u043f\u0430\u043a\u0442\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445, \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 OpenWrt.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-04T10:24:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-04T10:24:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dropbear SSH 2026.90 v\u00e4ljaanne haavatavuste k\u00f5rvaldamisega | ProHoster","description":"Avalikustatud on Dropbear 2026.90 v\u00e4ljaanne, mis arendab SSH serverit ja klienti, levides traadita ruuterites ja kompaktsetes distributsioonides, nagu OpenWrt.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a Dropbear SSH 2026.90 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Dropbear 2026.90, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 SSH, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0439 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0438 \u043a\u043e\u043c\u043f\u0430\u043a\u0442\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445, \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 OpenWrt.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-dropbear-ssh-2026-90-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-04T10:24:42+00:00","article:modified_time":"2026-05-04T10:24:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=170353"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170353\/revisions"}],"predecessor-version":[{"id":173160,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/170353\/revisions\/173160"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=170353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=170353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=170353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}