Arch Linux alert ASA-202505-9 (dropbear)

From:
             
 
Andrea Denisse <denisse@archlinux.org>
To:
             
 
arch-security <arch-security@lists.archlinux.org>
Subject:
             
 
[ASA-202505-9] dropbear: arbitrary command execution
Date:
             
 
Tue, 20 May 2025 13:16:28 -0600
Message-ID:
             
 
<3a1dcfc92201b742205a274811ad29dc1e048af2.camel@archlinux.org>
Archive-link:
             
 
Article
Arch Linux Security Advisory ASA-202505-9
=========================================

Severity: Medium
Date    : 2025-05-19
CVE-ID  : CVE-2025-47203
Package : dropbear
Type    : arbitrary command execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2874

Summary
=======

The package dropbear before version 2025.88-1 is vulnerable to
arbitrary command execution.

Resolution
==========

Upgrade to 2025.88-1.

# pacman -Syu "dropbear>=2025.88-1"

The problem has been fixed upstream in version 2025.88.

Workaround
==========

None.

Description
===========

dbclient in Dropbear SSH before 2025.88 allows command injection via an
untrusted hostname argument, because a shell is used.

Impact
======

A remote attacker can craft a malicious hostname to execute arbitrary
commands on a system using dbclient if the hostname is passed without
proper sanitization.

References
==========

https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2025q2...
https://security.archlinux.org/CVE-2025-47203