PatchTheCVEdropbear ssh vulnerabilities and fixes
Recent CVEs affecting dropbear ssh, with upgrade or downgrade steps. 3 tracked.
Also searched as: dropbearssh.
dropbear ssh has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-10-12. Highest priority: CVE-2021-36369 (score 56/100).
- CVE-2021-36369 HIGH 7.5 UPGRADE MITIGATE An issue was discovered in Dropbear through 2020.81
- CVE-2020-36254 HIGH 8.1 UPGRADE scp.c in Dropbear before 2020.79 mishandles the filename of
- CVE-2019-12953 MEDIUM 5.3 UPGRADE Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames,
FAQ
How do I fix dropbear ssh vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dropbear ssh being exploited right now?
None of the tracked dropbear ssh CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dropbear ssh CVE should I patch first?
CVE-2021-36369 currently ranks highest (56/100): An issue was discovered in Dropbear through 2020.81.