| Message ID | 20250509041939.11656-1-kadambini.nema@gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/1] package/dropbear: security bump to version 2025.88 | expand |
Hi Kadambini Nema, On Thu, May 08 2025, Kadambini Nema wrote: > Fixes CVE-2025-47203. > https://security-tracker.debian.org/tracker/CVE-2025-47203 > > Release notes: > https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.88 > https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.87 The 2025.87 release removed SHA-1 from the default build. See my comment on Bernd's suggested 2025.87 bump patch: https://lore.kernel.org/all/874j02d3h7.fsf@tarshish/ https://lore.kernel.org/all/20250309083216.824179-1-bernd@kuhls.net/ baruch > Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com> > --- > package/dropbear/dropbear.hash | 2 +- > package/dropbear/dropbear.mk | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/package/dropbear/dropbear.hash b/package/dropbear/dropbear.hash > index cf2dd18d61..b18aca3aab 100644 > --- a/package/dropbear/dropbear.hash > +++ b/package/dropbear/dropbear.hash > @@ -1,5 +1,5 @@ > # From https://matt.ucc.asn.au/dropbear/releases/SHA256SUM.asc > -sha256 e78936dffc395f2e0db099321d6be659190966b99712b55c530dd0a1822e0a5e dropbear-2024.86.tar.bz2 > +sha256 783f50ea27b17c16da89578fafdb6decfa44bb8f6590e5698a4e4d3672dc53d4 dropbear-2025.88.tar.bz2 > > # License file, locally computed > sha256 a99ce657d790b761c132ee7e0de18edb437ae6361e536d991c6a12f36e770445 LICENSE > diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk > index e043893aa1..c383212e76 100644 > --- a/package/dropbear/dropbear.mk > +++ b/package/dropbear/dropbear.mk > @@ -4,7 +4,7 @@ > # > ################################################################################ > > -DROPBEAR_VERSION = 2024.86 > +DROPBEAR_VERSION = 2025.88 > DROPBEAR_SITE = https://matt.ucc.asn.au/dropbear/releases > DROPBEAR_SOURCE = dropbear-$(DROPBEAR_VERSION).tar.bz2 > DROPBEAR_LICENSE = MIT, BSD-2-Clause, Public domain
>>>>> "Baruch" == Baruch Siach via buildroot <buildroot@buildroot.org> writes: > Hi Kadambini Nema, > On Thu, May 08 2025, Kadambini Nema wrote: >> Fixes CVE-2025-47203. >> https://security-tracker.debian.org/tracker/CVE-2025-47203 >> >> Release notes: >> https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.88 >> https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.87 > The 2025.87 release removed SHA-1 from the default build. See my comment > on Bernd's suggested 2025.87 bump patch: > https://lore.kernel.org/all/874j02d3h7.fsf@tarshish/ > https://lore.kernel.org/all/20250309083216.824179-1-bernd@kuhls.net/ Thanks. I committed Berns 2025.87 bump with that and then this commit on top. Committed, thanks.
diff --git a/package/dropbear/dropbear.hash b/package/dropbear/dropbear.hash index cf2dd18d61..b18aca3aab 100644 --- a/package/dropbear/dropbear.hash +++ b/package/dropbear/dropbear.hash @@ -1,5 +1,5 @@ # From https://matt.ucc.asn.au/dropbear/releases/SHA256SUM.asc -sha256 e78936dffc395f2e0db099321d6be659190966b99712b55c530dd0a1822e0a5e dropbear-2024.86.tar.bz2 +sha256 783f50ea27b17c16da89578fafdb6decfa44bb8f6590e5698a4e4d3672dc53d4 dropbear-2025.88.tar.bz2 # License file, locally computed sha256 a99ce657d790b761c132ee7e0de18edb437ae6361e536d991c6a12f36e770445 LICENSE diff --git a/package/dropbear/dropbear.mk b/package/dropbear/dropbear.mk index e043893aa1..c383212e76 100644 --- a/package/dropbear/dropbear.mk +++ b/package/dropbear/dropbear.mk @@ -4,7 +4,7 @@ # ################################################################################ -DROPBEAR_VERSION = 2024.86 +DROPBEAR_VERSION = 2025.88 DROPBEAR_SITE = https://matt.ucc.asn.au/dropbear/releases DROPBEAR_SOURCE = dropbear-$(DROPBEAR_VERSION).tar.bz2 DROPBEAR_LICENSE = MIT, BSD-2-Clause, Public domain
Fixes CVE-2025-47203. https://security-tracker.debian.org/tracker/CVE-2025-47203 Release notes: https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.88 https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2025.87 Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com> --- package/dropbear/dropbear.hash | 2 +- package/dropbear/dropbear.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)