Description (CNA)
dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Dropbear SSH Project / Dropbear SSH | affected 0 before 2025.88 |
CWE
CWE-78
References
- https://github.com/mkj/dropbear/blob/master/src/cli-main.c
- https://github.com/mkj/dropbear/blob/master/CHANGES
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.
- http://www.openwall.com/lists/oss-security/2025/05/09/4
- http://www.openwall.com/lists/oss-security/2025/05/12/6
- http://www.openwall.com/lists/oss-security/2025/05/13/1
- http://www.openwall.com/lists/oss-security/2025/05/13/3
- http://www.openwall.com/lists/oss-security/2025/05/13/10
- https://lists.debian.org/debian-lts-announce/2025/05/msg00020.html