<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<h1
style="color: rgb(0, 0, 0); font-family: "Times New Roman"; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Forbidden</h1>
<p
style="color: rgb(0, 0, 0); font-family: "Times New Roman"; font-size: medium; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">You
don't have permission to access this resource.</p>
<p><br>
</p>
<div class="moz-cite-prefix">Am 07.05.2025 um 14:29 schrieb Matt
Johnston:<br>
</div>
<blockquote type="cite"
cite="mid:aBtSRnNljVsLuKKP@ucc.gu.uwa.edu.au">
<pre wrap="" class="moz-quote-pre">Hi all,
Dropbear 2025.88 is released. It has a few regression fixes
from 2025.87, and a security fix applicable to users of
dbclient where the hostname argument might be set from
untrusted input.
<a class="moz-txt-link-freetext" href="https://matt.ucc.asn.au/dropbear/">https://matt.ucc.asn.au/dropbear/</a>
<a class="moz-txt-link-freetext" href="https://dropbear.nl/mirror/">https://dropbear.nl/mirror/</a>
Cheers,
Matt
2025.88 - 7 May 2025
- Security: Don't allow dbclient hostname arguments to be interpreted
by the shell.
dbclient hostname arguments with a comma (for multihop) would be
passed to the shell which could result in running arbitrary shell
commands locally. That could be a security issue in situations
where dbclient is passed untrusted hostname arguments.
Now the multihop command is executed directly, no shell is involved.
Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203
- Fix compatibility for htole64 and htole32, regression in 2025.87
Patch from Peter Fichtner to work with old GCC versions, and
patch from Matt Robinson to check different header files.
- Fix building on older compilers or libc that don't support
static_assert(). Regression in 2025.87
- Support ~R in the client to force a key re-exchange.
- Improve strict KEX handling. Dropbear previously would allow other
packets at the end of key exchange prior to receiving the remote
peer's NEWKEYS message, which should be forbidden by strict KEX.
Reported by Fabian Bäumer.
</pre>
</blockquote>
</body>
</html>