This translation is older than the original page and might be outdated. See what has changed.


点击 这里访问旧版信息。

本页面罗列了用于确保OpenWrt安全性的流程、工具及机制。 涵盖了由所承载的官方软件包源及承载的procd、ubus和libubox。

Security bugs should be reported in confidentiality to, see Reporting security bugs for details.

This lists the currently support or not supported OpenWrt versions.

Version Current status Projected EOL
19.07 Fully supported August 2021
18.06 End of life December 2020
17.01 End of life EOL
15.05 End of life EOL

The Version references the most recent stable version from this release branch.

  • Fully supported means that the OpenWrt team provides updates for the core packages fixing security and other problems we are aware of.
  • Security maintenance means that the OpenWrt team fixes only security problems in this release but no bugs any more.
  • End of life means that we will *not* provide any updates also for severe security problem. Please update to more recent versions.

The Projected EOL can be extended later, depending on the future situation, like the release date of the next release.

This only covers the core OpenWrt packages and not the external package feeds hosted on github. Some feed package maintainer do not take care of all OpenWrt versions where the the core components are still supported. For the best security support we suggest everyone to upgrade to the most recent stable version.

The OpenWrt project uses multiple tools to identify potential security problems. The information are normally available for everyone and we appreciate fixes for problems reported by these tools form everyone.

This report shows the version number of all packages from the base and the package repository and compares it against the recent upstream released versions. In addition the tool which generates this page also checks for existing CVEs assigned to the packages based on the Common Platform Enumeration (CPE) which is listed in the PKG_CPE_ID variable of many packages. This page is weekly regenerated for master and the active release branches.

OpenWrt uses the commercial Coverity Scan tool which is available for free to open source projects to do static code analyses on the OpenWrt components. This scans one OpenWrt build per week and reports the problems found in the components developed in the OpenWrt project like procd and ubus, but not on (patched) third party components.

OpenWrt releases should be reproducible to make it possible to check that the releases we produced are really matching the source code we delivered and no backdoors were introduced in the build process. The reproducible builds project checks that OpenWrt master is still reproducible and publishes the results here:

OpenWrt operates multiple build bot instances which are building snapshots of the master and the supported release branches. See Buildbot for details.

When a change to a package is committed to the OpenWrt base repository of package feed the build bots are automatically detection this change and will rebuild this package. The new newly build package can then be installed with opkg or be integrated with the image builder by users of OpenWrt. This allows us to ship updates in about 2 days to the end users.

The kernel is normally located in its own partition and upgrades are not so easily possible. Therefore this mechanism currently does not work for the kernel itself and kernel modules, there a new minor release is needed to ship fixes to end users.

OpenWrt activates some build hardening options at compile time for all packages build.

Source: config/ Note that individual packages and/or targets may ignore or otherwise not respect these settings.

.config line Enabled by Default? Notes
CONFIG_PKG_CHECK_FORMAT_SECURITY=y Yes -Wformat -Werror=format-security
CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y -fstack-protector-strong
CONFIG_PKG_FORTIFY_SOURCE_1=y Yes -D_FORTIFY_SOURCE=1 (Using fortify-headers for musl libc)
CONFIG_PKG_FORTIFY_SOURCE_2=y -D_FORTIFY_SOURCE=2 (Using fortify-headers for musl libc)
CONFIG_PKG_RELRO_FULL=y Yes -Wl,-z,now -Wl,-z,relro
CONFIG_PKG_ASLR_PIE=y -PIE (some own spec file)
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2020/12/31 10:01
  • by lujimmy