Vulnerabilities > Dropbear SSH Project
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-12-18 | CVE-2023-48795 | Improper Validation of Integrity Check Value vulnerability in multiple products The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. network high complexity openbsd putty filezilla-project microsoft panic roumenpetrov winscp bitvise lancom-systems vandyke libssh net-ssh ssh2-project proftpd freebsd crates tera-term-project oryx-embedded crushftp netsarang paramiko redhat golang russh-project sftpgo-project erlang matez libssh2 asyncssh-project dropbear-ssh-project jadaptive ssh thorntech netgate connectbot apache tinyssh trilead 9bis gentoo fedoraproject debian apple CWE-354 | 5.9 |
| 2022-10-12 | CVE-2021-36369 | Improper Authentication vulnerability in multiple products An issue was discovered in Dropbear through 2020.81. | 7.5 |
| 2021-02-25 | CVE-2020-36254 | Unspecified vulnerability in Dropbear SSH Project Dropbear SSH scp.c in Dropbear before 2020.79 mishandles the filename of . | 8.1 |
| 2020-12-30 | CVE-2019-12953 | Information Exposure Through Discrepancy vulnerability in Dropbear SSH Project Dropbear SSH Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599. | 5.3 |
| 2019-03-21 | CVE-2017-2659 | Improper Authentication vulnerability in Dropbear SSH Project Dropbear SSH It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. | 7.5 |
| 2018-08-21 | CVE-2018-15599 | Information Exposure vulnerability in multiple products The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase. | 5.3 |
| 2017-05-19 | CVE-2017-9079 | Incorrect Permission Assignment for Critical Resource vulnerability in multiple products Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. | 4.7 |
| 2017-05-19 | CVE-2017-9078 | Double Free vulnerability in multiple products The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled. | 8.8 |
| 2017-03-03 | CVE-2016-7409 | Information Exposure vulnerability in Dropbear SSH Project Dropbear SSH The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident. | 5.5 |
| 2017-03-03 | CVE-2016-7408 | Improper Access Control vulnerability in Dropbear SSH Project Dropbear SSH The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument. | 8.8 |