VDB
CVE-2012-0920
CVE-2012-0920
PUBLISHED
CVSS 7.099999904632568 HIGH
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."
EPSS 1.80% · 83.2th percentile
Risk Scores
CVSS 2.0
7.099999904632568
EPSS Score
1.80%
83.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| dropbear_ssh_project | dropbear_ssh | 0.52 |
| debian | debian_linux | 6.0, 7.0 |
| n/a | n/a | n/a |
Timeline
- Feb 24, 2012 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Sep 7, 2023 EPSS Score
References
- dropbear-code-execution(73444) vdb
- 48147 third-party-advisory
- DSA-2456 vendor-advisory
- 79590 vdb
- http://matt.ucc.asn.au/dropbear/CHANGES url
- 52159 vdb
- https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749 url
- https://www.mantor.org/~northox/misc/CVE-2012-0920.html url
- 48929 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-0920 advisory