ALPINE-CVE-2017-9079

See a problem?
Please try reporting it to the source first.

Source

https://security.alpinelinux.org/vuln/CVE-2017-9079

Import Source

https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2017-9079.json

JSON Data

https://api.osv.dev/v1/vulns/ALPINE-CVE-2017-9079

Upstream

CVE-2017-9079

Published

2017-05-19T14:29:00.310Z

Modified

2025-11-19T06:11:43.403833Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorizedkeys file format with a command= option. This occurs because ~/.ssh/authorizedkeys is read with root privileges and symlinks are followed.

References

https://security.alpinelinux.org/vuln/CVE-2017-9079

Affected packages

Alpine:v3.4 / dropbear

Package

Name: dropbear
Purl: pkg:apk/alpine/dropbear?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2017.75-r0

Affected versions

0.*

0.52-r0

0.52-r1

0.52-r2

0.52-r3

0.52-r4

0.53.1-r0

0.53.1-r1

2012.*

2012.55-r0

2013.*

2013.58-r0

2014.*

2014.63-r0

2014.65-r0

2014.66-r0

2014.66-r1

2015.*

2015.67-r0

2015.68-r0

2015.68-r1

2015.68-r2

2015.70-r2

2015.71-r0

2015.71-r1

2016.*

2016.73-r0

2016.74-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2017-9079.json"

Alpine:v3.5 / dropbear