dropbear (2026.92-1) unstable; urgency=medium

  * New upstream bugfix and security release.

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 06 Jul 2026 17:57:05 +0200

dropbear (2026.91-1) unstable; urgency=medium

  * New upstream bugfix release.
  * Add patch to skip dropbearconvert(1) test for key type ed25519 in legacy
    PEM format which is no longer possible as of ssh-keygen(1) from OpenSSH
    10.3p1.

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 11 May 2026 15:27:13 +0200

dropbear (2026.90-1) unstable; urgency=medium

  * New upstream security and bugfix release (closes: #1044936, #1130870).
  * Update Standards-Version to 4.7.4.
    + Remove "Priority: optional" which is the current default and spelling it
      out is no longer recommended per Policy.

 -- Guilhem Moulin <guilhem@debian.org>  Sun, 03 May 2026 13:30:20 +0200

dropbear (2025.89-1) unstable; urgency=high

  * New upstream security and bugfix release (closes: #1123069).
    + Fix CVE-2025-14282: Privilege escalation via unix stream forwarding in
      Dropbear server. Other programs on a system may authenticate unix
      sockets via SO_PEERCRED, which would be root user for Dropbear forwarded
      connections, allowing root privilege escalation.
    + Unix stream sockets are now disallowed when a forced command is used,
      either with authorized_key restrictions or "dropbear -c command".
    + The server now drops privileges of the dropbear process after
      authentication.
    + Remote server TCP socket forwarding will now use OS privileged port
      restrictions rather than having a fixed "allow >=1024 for non-root"
      rule.
  * d/control: Remove `Rules-Requires-Root: no`.
  * d/s/lintian-overrides: Drop unused override.
  * d/watch: Port to Version 5.

 -- Guilhem Moulin <guilhem@debian.org>  Tue, 16 Dec 2025 17:14:59 +0100

dropbear (2025.88-2) unstable; urgency=medium

  [ Guilhem Moulin ]
  * d/control: Explicitly add `Build-Depends: libcrypt-dev`.
    (Closes: #1106965)

  [ MichaIng ]
  * d/rules: Build with `--disable-lastlog` as Trixie ships without
    lastlog(8), see #1083102.

 -- Guilhem Moulin <guilhem@debian.org>  Tue, 08 Jul 2025 23:05:41 +0200

dropbear (2025.88-1) unstable; urgency=medium

  * New upstream security and bugfix release.
    + Fix CVE-2025-47203: dbclient allows command injection via an untrusted
      hostname argument, because a shell is used.
  * Update Standards-Version to 4.7.2 (no changes necessary).

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 07 May 2025 17:02:27 +0200

dropbear (2025.87-1) unstable; urgency=low

  * New upstream release.  Highlights includes:
    + Post-quantum key exchange algorithms sntrup761 and ML-KEM are now
      supported.

    + Compression is now disabled for dropbear(8) in the client to server
      direction.  This avoids attack surface for zlib, and also saves 35kB
      runtime RAM for the decompression context.

    + Due to vulnerabilities in the SHA-1 digest algorithm, dropbear(8) and
      dbclient(1) are now built without support for the ‘hmac-sha1’ integrity
      algorithm, ‘ssh-rsa’ key algorithm, and ‘diffie-hellman-group14-sha1’
      key exchange algorithm.  (The ‘diffie-hellman-group1-sha1’ key exchange
      algorithm, which also uses SHA-1, has been disabled at build time for
      dropbear(8) since 2018.76-1, but remains available to dbclient(1).)

      Note that OpenSSH has disabled support for these algorithms by default
      (runtime) since 8.8.  There is *no need* to rotate existing RSA host or
      user keys: OpenSSH has been supporting RFC8332 RSA/SHA-256/512
      signatures since 7.2, and dropbear since 2020.79.  However this change
      might break connection to legacy servers resp. from legacy clients.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 05 Mar 2025 17:20:35 +0100

dropbear (2024.86-2) unstable; urgency=medium

  [ Reto Schneider ]
  * initramfs hook: Update SSH key type check

  [ Guilhem Moulin ]
  * initramfs hook: Make authorized_keys(5) regex more robust.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 01 Jan 2025 11:49:32 +0100

dropbear (2024.86-1) unstable; urgency=medium

  * New upstream bugfix release.
  * d/README.initramfs: Account for compressed kernel modules in module
    listing command.
  * Remove d/*.patch applied upstream.
  * d/t/control: Add "Depends: python3-asyncssh" to upstream-tests.
  * d/t/upstream-tests: convert ECDSA key to openssh format so that asyncssh
    can find it.

 -- Guilhem Moulin <guilhem@debian.org>  Wed, 23 Oct 2024 17:29:07 +0200

dropbear (2024.85-3) unstable; urgency=medium

  * DEP-8: Mark remote-unlocking as flaky.  To be re-evaluated if/when the
    test runs on environment where KVM is available.  (Closes: #1072947)
  * d/t/remote-unlocking: Also install systemd-cryptsetup in the guest.  This
    is needed to unlock the swap device at boot time (not at initramfs stage).

 -- Guilhem Moulin <guilhem@debian.org>  Tue, 09 Jul 2024 12:07:08 +0200

dropbear (2024.85-2) unstable; urgency=medium

  * DEP-8: Mark upstream-tests as flaky. (Closes: #1072369)

 -- Guilhem Moulin <guilhem@debian.org>  Mon, 03 Jun 2024 00:24:16 +0200

dropbear (2024.85-1) unstable; urgency=medium

  * New upstream bugfix release.
  * Update Standards-Version to 4.7.0 (no changes necessary).

 -- Guilhem Moulin <guilhem@debian.org>  Fri, 26 Apr 2024 12:04:25 +0200

dropbear (2024.84-1) unstable; urgency=medium

  * New upstream bugfix release.
  * Remove legacy maintscripts.
  * Refresh d/patches and remove those applied upstream.
  * Update d/copyright, d/*.docs and d/s/lintian-overrides to reflect the new
    upstream layout.
  * d/control: Demote Depends: sysvinit-utils to Suggests and drop lsb-base
    alternative.
  * d/t/upstream-tests: Create ~/.ssh/authorized_keys with mode 0600 as
    dropbear now checks its permissions.

 -- Guilhem Moulin <guilhem@debian.org>  Thu, 04 Apr 2024 17:18:48 +0200

dropbear (2022.83-4) unstable; urgency=medium

  * Fix CVE-2023-48795: (terrapin attack): The SSH transport protocol with
    certain OpenSSH extensions allows remote attackers to bypass integrity
    checks such that some packets are omitted (from the extension negotiation
    message), and a client and server may consequently end up with a
    connection for which some security features have been downgraded or
    disabled, aka a Terrapin attack. (Closes: #1059001)

 -- Guilhem Moulin <guilhem@debian.org>  Thu, 25 Jan 2024 02:08:38 +0100

dropbear (2022.83-3) unstable; urgency=medium

  * d/control: Drop dropbear-run binary package. (Closes: #1038256)
  * initramfs hook: Reuse ~root if set up in $DESTDIR. (Closes: #1056274)
  * Refresh d/patches.
  * Cherry-pick upstream commit to remove more files in distclean.
    (Closes: #1044936)

 -- Guilhem Moulin <guilhem@debian.org>  Tue, 21 Nov 2023 12:24:46 +0100

dropbear (2022.83-2) unstable; urgency=medium

  * d/.gitattribute: New file for proper merging of d/changelog.
  * Update standards version to 4.6.2, no changes needed.
  * d/u/metadata: Replace hg.ucc.asn.au repo with GitHub.
    https://hg.ucc.asn.au/dropbear has not been updated since 2022.82 and the
    homepage doesn't advertize it anymore.
  * d/control: dropbear: Replace ‘Depends: lsb-base (>= 3.0-6)’ with
    ‘sysvinit-utils (>= 3.05-4~) | lsb-base (>= 3.0-6)’.

 -- Guilhem Moulin <guilhem@debian.org>  Sat, 10 Jun 2023 22:56:47 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog dropbear-bin`.
