CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
CVSS Details
- CVSS 3.1 Base Score: 6.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade dropbear | Aug 30, 2017 | Mar 22, 2016 |
| Debian | — | Upgrade dropbear | Jul 30, 2024 | Mar 22, 2016 |
| Freebsd | — | Upgrade dropbear | Dec 10, 2025 | Mar 14, 2016 |
| Gentoo Linux | — | Upgrade net-misc/dropbear. | Oct 30, 2017 | Mar 22, 2016 |
| Suse | — | Upgrade dropbear-debugsourceUpgrade dropbear-debuginfoUpgrade dropbear | Mar 28, 2016 | Mar 22, 2016 |
| Ubuntu | — | Upgrade dropbear | Nov 19, 2024 | Mar 22, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub