CVE-2017-9079
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has...
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
CVE-2017-9079- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.7 Medium
AV:L/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
CVE List No score
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
CVE-2017-9079- Updated
- 2026-11-02
EUVDEUVD-2017-18018 No score
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
EUVD-2017-18018- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j5rr-cpp9-c4r6
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has...
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
GHSA-j5rr-cpp9-c4r6- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-9079
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
ALPINE-CVE-2017-9079- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
CVE-2017-9079- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-9079
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
DEBIAN-CVE-2017-9079- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-9079
Dropbear before 2017.75 might allow local users to read certain files as root, if the file has the authorized_keys file format with a command= option. This occurs because ~/.ssh/authorized_keys is read with root privileges and symlinks are followed.
- Record
UBUNTU-CVE-2017-9079- CVSS 3.0
- 4.7 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0165 No score
Updated dropbear packages fix security vulnerability
A double-free in the server could be triggered by an authenticated user if dropbear is running with -a (CVE-2017-9078). The default Mageia configuration does not set -a, so is not vulnerable
Dropbear parsed authorized_keys as root, even if it were a symlink. The fix is to switch to user permissions when opening authorized_keys (CVE-2017-9079)
- Record
MGASA-2017-0165- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dropbearAlpine:v3.4 |
before 2017.75-r0 | 2017.75-r0 |
dropbearAlpine:v3.5 |
before 2017.75-r0 | 2017.75-r0 |
dropbearDebian:12 |
before 2016.74-5 | 2016.74-5 |
dropbearDebian:13 |
before 2016.74-5 | 2016.74-5 |
dropbearDebian:14 |
before 2016.74-5 | 2016.74-5 |
dropbearDebian:7 |
before 2012.55-1.3+deb7u2, plus listed versions 2012.55-1.32012.55-1.3+deb7u1 |
2012.55-1.3+deb7u2 |
dropbearDebian:8 From an advisory covering 2 CVEs |
before 2014.65-1+deb8u2, plus listed versions 2014.65-12014.65-1+deb8u1 |
2014.65-1+deb8u2 |
dropbearMageia:5 From an advisory covering 2 CVEs |
before 2014.66-1.3.mga5 | 2014.66-1.3.mga5 |
dropbearUbuntu:16.04:LTS |
All versions, plus listed versions 2014.65-1ubuntu22015.68-12015.70-12015.71-12016.72-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-9079 is a medium vulnerability (CVSS 4.7) in Dropbear Ssh Project Ssh, published May 19, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in dropbear 2017.75-r0.