{"id":"CVE-2016-3116","aliases":["DEBIAN-CVE-2016-3116","EUVD-2016-4169","GHSA-qrcr-w7v9-jxvw","MGASA-2016-0113"],"status":"published","title":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to...","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","severity":{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.19805,"percentile":0.97428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2016-03-16T18:07:23Z","modified":"2026-09-22T07:02:58Z","exploits":[{"source":"exploitdb","id":"EDB-40119","title":"DropBearSSHD 2015.71 - Command Injection","type":"remote","platform":"linux","date":"2016-03-03","url":"https://www.exploit-db.com/exploits/40119"},{"source":"pocgithub","id":"mxypoo/CVE-2016-3116-DropbearSSH","title":"mxypoo/CVE-2016-3116-DropbearSSH","date":"2022-02-22","url":"https://github.com/mxypoo/CVE-2016-3116-DropbearSSH"}],"fixes":[{"ecosystem":"Debian:12","package":"dropbear","fixed_in":["2016.72-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dropbear","fixed_in":["2016.72-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dropbear","fixed_in":["2016.72-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"dropbear","fixed_in":["2014.66-1.1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.72-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.72-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.72-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.66-1.1.mga5"}]}]}],"products":[{"vendor":"dropbear_ssh_project","product":"dropbear_ssh"}],"references":[{"url":"https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-3115","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://matt.ucc.asn.au/dropbear/CHANGES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179269.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/136251/Dropbear-SSHD-xauth-Command-Injection-Bypass.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179261.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2016/Mar/47","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179870.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-03/msg00113.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201607-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-03/msg00105.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3116"},{"url":"https://github.com/advisories/GHSA-qrcr-w7v9-jxvw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3116","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17948","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2016/03/10/16","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3116","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","status":"published","published":"2016-03-22T10:00:00Z","modified":"2024-08-05T23:47:57.124Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2016-4169","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","status":"published","published":"2016-03-22T10:00:00Z","modified":"2024-08-05T23:47:57Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-qrcr-w7v9-jxvw","title":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to...","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","status":"published","published":"2022-05-17T03:30:54Z","modified":"2023-01-27T05:07:38Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:43:09.795502Z"}],"nvd":[{"id":"CVE-2016-3116","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","status":"published","published":"2016-03-22T10:59:03.98Z","modified":"2026-06-17T00:45:00.123Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-3116","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","status":"published","published":"2016-03-22T10:59:03.98Z","modified":"2026-04-16T06:25:46.957255615Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-3116","description":"CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.","status":"published","published":"2016-03-22T10:59:03.98Z","modified":"2026-09-22T07:02:58.60967536Z","cvss":[{"version":"3.0","score":6.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"MGASA-2016-0113","title":"Updated dropbear packages fix CVE-2016-3116","description":"Updated dropbear package fixes security vulnerability:\n\nMissing validation of X11 forwarding input could allow bypassing of\nauthorized_keys command= restrictions (CVE-2016-3116).\n","status":"published","published":"2016-03-16T18:07:23Z","modified":"2026-04-16T06:22:29.281373396Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}