CVE-2007-1099 — Insufficient UI Warning of Dangerous Operations in SSH Project Dropbear SSH

CWE-357 — Insufficient UI Warning of Dangerous Operations6 documents6 sources
Severity
7.5HIGHNVD
EPSS
1.7%
top 17.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dropbear SSH Project Dropbear SSHDebian Dropbear
Timeline
PublishedFeb 26
Latest updateMay 1

Description

dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/dropbear< dropbear 0.49-1 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-4qp5-f859-rjjf: dbclient in Dropbear SSH client before 0↗2022-05-01
▶
OSV
CVE-2007-1099: dbclient in Dropbear SSH client before 0↗2007-02-26
▶

📋Vendor Advisories

1
Debian
CVE-2007-1099: dropbear - dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user ...↗2007
▶

📐Framework References

1
CWE
Insufficient UI Warning of Dangerous Operations↗
▶