Debian alert DLA-4169-1 (dropbear)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4169-1] dropbear security update
Date:
             
 
Sat, 17 May 2025 22:28:26 +0200
Message-ID:
             
 
<aCjxatb2lzOjuKRq@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4169-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
May 17, 2025                                  https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : dropbear
Version        : 2020.81-3+deb11u3
CVE ID         : CVE-2025-47203

Marcin Nowak discovered that dbclient(1) hostname arguments with a comma
(for multihop) are passed to the shell which could result in running
arbitrary shell commands locally.  That could be a security issue in
situations where dbclient(1) is passed untrusted hostname arguments.

For Debian 11 bullseye, this problem has been fixed in version
2020.81-3+deb11u3.

We recommend that you upgrade your dropbear packages.

For the detailed security status of dropbear please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/dropbear

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmgo8WoACgkQ05pJnDwh
pVKBmw//e2ZxN3cYyFG2YcGIIuJWziN5n9bQoaA3VVQsp5HpeX3/JAxXeRyDwx/L
GPNwROe8ZitUlXuLNwrHG9CEx/p/LXXswENWVXvPQ+uQ7g/jWZuHiRYU+NxAm4Cx
4IhjoL2bOILCO68uUxfo3ZJrIu7y/9Q4o+a5gLaZsRZvHhRn6t544rFuOiuZWsCa
+TQh66ZNWpeoVcUgH6blgozdFCTFl0lNXK4xhgtrcmaA6M6W1B0++U3FQ3MfVK5w
dd4T7OTmq5o1m8Pha8SVnjBPY5HGmzVNdpa6GeS/vrYufzzjykZky0XAs6TS9jOL
COn/1yn+AKTS7j9bN8Bw1hk65S4f+fkUhy+g+wKBKugDSMXD2lPv8YYFO7j7GApg
8glwFZnuG7lm/RhRGzVUZscakTGd+M/IluTr1921FqDpJVQKWGOx6TeGCOAMCCiv
dNyPtt52qqPLGHH6a2kLq/sBPOu5e69cEnJoWUl9ifbYi8cyjSsWkZJAj/urMX3q
IhWd74aNda4LtCz2OIzwvybkIPDs4vjZmXYIRm7iM0Tu30I2Lhal49aka3VjF+AY
pPamaQpF/gCEKDjU5KIyf0o3QQhgZJsFKyo+zdBBYMsSrjpKyvHhvzZwRIcPTJ58
a49QawmINT/wY3kDlQupQMmLBZlU8gcxeTb8cAx080/e33XLAE0=
=SqEH
-----END PGP SIGNATURE-----