Every CVE Search/ Get API key

CVE-2020-36254

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related...

8.1 HighFix available

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.88%Up 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
CVE-2020-36254
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
CVE-2020-36254
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2020-23797 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
EUVD-2020-23797
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-36m7-j2mr-5864 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related...

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
GHSA-36m7-j2mr-5864
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2020-36254 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
ALPINE-CVE-2020-36254
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
CVE-2020-36254
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-36254 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
DEBIAN-CVE-2020-36254
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-36254 8.1

scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.

Record
UBUNTU-CVE-2020-36254
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dropbear
Alpine:v3.10
 before 2019.78-r1
2019.78-r1
dropbear
Alpine:v3.11
 before 2019.78-r1
2019.78-r1
dropbear
Alpine:v3.12
 before 2019.78-r1
2019.78-r1
dropbear
Debian:12
 before 2020.79-1
2020.79-1
dropbear
Debian:13
 before 2020.79-1
2020.79-1
dropbear
Debian:14
 before 2020.79-1
2020.79-1
dropbear
Ubuntu:16.04:LTS
 All versions, plus listed versions
2014.65-1ubuntu22015.68-12015.70-12015.71-12016.72-1
 None known
dropbear
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2017.75-22017.75-3build12017.75-3ubuntu0.1~esm1
 None known
dropbear
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2019.78-2build12019.78-2ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36254 is a high vulnerability (CVSS 8.1) in Dropbear Ssh Project Ssh, published February 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in dropbear 2019.78-r1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open