Description
dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Dropbear SSH Project Dropbear SSH
Default version status: unaffected
0 to < 2025.88affected
References
- https://github.com/mkj/dropbear/blob/master/src/cli-main.c ↗
- https://github.com/mkj/dropbear/blob/master/CHANGES ↗
- http://www.openwall.com/lists/oss-security/2025/05/09/4 ↗
- http://www.openwall.com/lists/oss-security/2025/05/12/6 ↗
- http://www.openwall.com/lists/oss-security/2025/05/13/1 ↗
- http://www.openwall.com/lists/oss-security/2025/05/13/3 ↗
- http://www.openwall.com/lists/oss-security/2025/05/13/10 ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00020.html ↗