Known Vulnerabilities for Dropbear Ssh by Dropbear Ssh Project

Listed below are 10 of the newest known vulnerabilities associated with "Dropbear Ssh" by "Dropbear Ssh Project".

These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.

Data on known vulnerable versions is also displayed based on information from known CPEs

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2021-36369 An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods... 7.5 - HIGH 2022-10-12 2023-01-20
CVE-2020-36254 scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685. 8.1 - HIGH 2021-02-25 2021-09-17
CVE-2019-12953 Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different is... 5.3 - MEDIUM 2020-12-30 2021-07-21
CVE-2018-15599 The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability... 5.3 - MEDIUM 2018-08-21 2020-12-30
CVE-2017-9079 Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file forma... 4.7 - MEDIUM 2017-05-19 2019-10-04
CVE-2017-9078 The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in ... 8.8 - HIGH 2017-05-19 2022-07-11
CVE-2017-2659 It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an inval... 7.5 - HIGH 2019-03-21 2019-10-09
CVE-2016-7407 The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH k... 9.8 - CRITICAL 2017-03-03 2017-03-04
CVE-2016-7406 Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format strin... 9.8 - CRITICAL 2017-03-03 2017-03-04
CVE-2016-3116 CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-comman... 6.4 - MEDIUM 2016-03-22 2016-12-03
Results limited to 10 most recent vulnerabilities

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationDropbear Ssh ProjectDropbear Ssh2018.76AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2017.75AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2016.74AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2016.73AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2016.72AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2015.71AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2015.70AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2015.69AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2015.68AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2015.67AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2014.66AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2014.65AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2014.64AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2014.63AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2013.62AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2013.61testAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2013.60AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2013.59AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2013.58AllAllAll
ApplicationDropbear Ssh ProjectDropbear Ssh2013.57AllAllAll
Results limited to 20 most recent known configurations
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report