Dropbear 2026.93

Author: mkj

CHANGES

@@ -1,3 +1,34 @@
+2026.93 - 21 July 2026
+
+Note >> for compatibility/configuration changes
+
+- Security: Fix a use-after-free in X11 forwarding that could possibly lead
+  to memory corruption. This is vulnerable to authenticated users if X11
+  forwarding is enabled. By default X11 forwarding is not built.
+  In 2026.89 the server is running as the authenticated user for X11
+  forwarding, in earlier versions it runs as root.
+  This removes X11 "single connection" which has probably never been used.
+  Reported by @peter-pe
+  https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4
+
+- >> "permitlisten" authorized_keys lines will now be ignored if
+  the port is invalid (>65536). From Basavaraj S Maneppagol.
+
+- >> In 2026.92, the configure option --enable-plugin-deprecated
+  wasn't correctly renamed. This is now implemented.
+  Patch from Alexander Dahl
+
+- Two factor auth "-t" is no longer deprecated, it will be kept.
+  The "DEPRECATED_TWO_FACTOR" option is ignored, and no longer required.
+
+- Fix out of bounds read during utmp/wtmp log file handling, reported by
+  Basavaraj S Maneppagol.
+
+- More robust handling of ascii inputs for some platforms.
+  From Basavaraj S Maneppagol
+
+- Convert manpages to mdoc format, from shrub
+
 2026.92 - 6 July 2026
 
 Note >> for compatibility/configuration changes

debian/changelog

@@ -1,3 +1,9 @@
+dropbear (2026.93-0.1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Matt Johnston <matt@ucc.asn.au>  Tue, 21 July 2026 22:51:57 +0800
+
 dropbear (2026.92-0.1) unstable; urgency=low
 
   * New upstream release.

src/sysoptions.h

@@ -4,7 +4,7 @@
  *******************************************************************/
 
 #ifndef DROPBEAR_VERSION
-#define DROPBEAR_VERSION "2026.92"
+#define DROPBEAR_VERSION "2026.93"
 #endif
 
 /* IDENT_VERSION_PART is the optional part after "SSH-2.0-dropbear". Refer to RFC4253 for requirements. */