CVE-2023-48795

CVE-2023-48795 is referenced across several connected advisories, detailing affected packages and required upgrades. Astra Linux/CBL-Mariner entries note: podman (<5.6.1-2) needs upgrade, erlang (<25.2-1), libssh2 (<1.11.1-1), libssh (<0.10.6-1), terraform (<1.3.2-25), kubevirt (&l...

CVE-2020-36254

CVE-2020-36254 : In Dropbear, the SCP client (scp.c) before version 2020.79 mishandles the filename of “.” or an empty filename, related to CVE-2018-20685. Affected: Dropbear releases prior to 2020.79. Impact and exploit details are not provided beyond the filename handling issue in scp. Remediat...

CVE-2017-9078

CVE-2017-9078 affects Dropbear server prior to 2017.75, where a post-authentication double-free during TCP listener cleanup (when -a is enabled) could allow root remote code execution. The connected sources document the vulnerability and its Fix: Dropbear updates to 2017.75+ (and related advisori...

CVE-2017-9079

Dropbear before 2017.75 may allow local users to read files as root when ~/.ssh/authorized_keys contains a command= option. The root privilege is involved because authorized_keys is read with root privileges and symlinks are followed. The underlying issue is that Dropbear parsed authorized_keys a...

CVE-2013-4421

CVE-2013-4421 affects Dropbear SSH Server prior to 2013.59, where the buf_decompress function in packet.c can be exploited by a compressed packet with large size to cause a denial of service via memory exhaustion. Public references describe the impact as memory consumption and note fixes in later...

CVE-2013-4434

Dropbear SSH Server before 2013.59 is affected by CVE-2013-4434: authentication error messages reveal valid usernames via different delay depending on account existence. Public docs confirm the issue and cite a patch release (2013.60) that fixes this and related CVE-2013-4421; openSUSE/Mandriva a...

CVE-2004-2486

The CVE-2004-2486 entry concerns Dropbear SSH Server before version 0.43, where the DSS verification code frees uninitialized variables. This memory handling issue could allow remote attackers to gain access. The available connected documents consistently identify the affected component (Dropbear...

CVE-2005-4178

CVE-2005-4178 refers to a buffer overflow in Dropbear SSH server prior to 0.47. The vulnerability arises from a memory allocation issue caused by an incorrect order of operations in an input handling path, allowing an authenticated user to execute arbitrary code on the server with the server user...

CVE-2017-2659

CVE-2017-2659 affects dropbear prior to 2013.59, where GSSAPI authentication failures are incorrectly counted toward the maximum password attempts when an invalid username is supplied. This leaks whether a username is valid or invalid during authentication, exposing a side channel that can aid cr...

CVE-2007-1099

Dropbear