CVE-2007-1099 dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dropbear ssh project dropbear ssh | < 0.49 | 0.49 |
| debian/dropbear(Debian:12) | < 0.49-1 | 0.49-1 |
| debian/dropbear(Debian:13) | < 0.49-1 | 0.49-1 |
| debian/dropbear(Debian:14) | < 0.49-1 | 0.49-1 |
References
- matt.ucc.asn.au vendor-advisory
- 33814 broken-link vdb-entry
- 24345 third-party-advisory
- 32088 broken-link vdb-entry
- 22761 third-party-advisory vdb-entry
- ADV-2007-0785 third-party-advisory vdb-entry
- dropbear-hostkey-weak-security(32762) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2007-1099 vendor-advisory
- bugs.debian.org issue-tracking