CVE-2025-47203
Fixed in a distro release EPSS <1%CVSS 4.5
dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.
Products: dropbear_ssh_project dropbear_ssh
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.24 | dropbear | 2025.88-r0 |
| Arch Linux | dropbear | 2025.88-1 |
| Debian 11 | dropbear | 2020.81-3+deb11u3 |
| Debian 12 | dropbear | 2022.83-1+deb12u3 |
| Debian 13 | dropbear | 2025.88-1 |
| Debian 14 | dropbear | 2025.88-1 |
| Ubuntu 16.04 LTS | dropbear | no fix |
| Ubuntu 22.04 LTS | dropbear | no fix |
| Ubuntu 24.04 LTS | dropbear | no fix |
| Ubuntu 25.10 | dropbear | no fix |
| Ubuntu Pro 18.04 LTS | dropbear | no fix |
| Ubuntu Pro 20.04 LTS | dropbear | no fix |