{"id":"CVE-2020-36254","aliases":["ALPINE-CVE-2020-36254","DEBIAN-CVE-2020-36254","EUVD-2020-23797","GHSA-36m7-j2mr-5864","UBUNTU-CVE-2020-36254"],"status":"published","title":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related...","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01876,"percentile":0.79586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-02-25T08:29:43Z","modified":"2026-10-26T12:02:49Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"dropbear","fixed_in":["2019.78-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"dropbear","fixed_in":["2019.78-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"dropbear","fixed_in":["2019.78-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dropbear","fixed_in":["2020.79-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dropbear","fixed_in":["2020.79-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dropbear","fixed_in":["2020.79-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.78-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.78-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.78-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.79-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.79-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.79-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2014.65-1ubuntu2","2015.68-1","2015.70-1","2015.71-1","2016.72-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2017.75-2","2017.75-3build1","2017.75-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dropbear","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2019.78-2build1","2019.78-2ubuntu0.1~esm1"]}],"products":[{"vendor":"dropbear_ssh_project","product":"dropbear_ssh"}],"references":[{"url":"https://github.com/mkj/dropbear/commit/8f8a3dff705fad774a10864a2e3dbcfa9779ceff","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36254"},{"url":"https://github.com/advisories/GHSA-36m7-j2mr-5864"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-36254","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-36254","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-36254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36254","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-36254","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T08:29:43Z","modified":"2025-12-03T18:09:57.191Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-23797","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T08:29:43Z","modified":"2025-12-03T18:09:57Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"ghsa":[{"id":"GHSA-36m7-j2mr-5864","title":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related...","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2022-05-24T17:43:02Z","modified":"2025-12-03T18:30:19Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:05:01.323335Z"}],"nvd":[{"id":"CVE-2020-36254","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T09:15:13.037Z","modified":"2026-06-17T03:15:13.253Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"ALPINE-CVE-2020-36254","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T09:15:13.037Z","modified":"2026-10-26T11:17:55.175661333Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-36254","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T09:15:13.037Z","modified":"2026-10-20T14:12:21.814850031Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-36254","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T09:15:13.037Z","modified":"2026-10-26T12:02:49.504710042Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"UBUNTU-CVE-2020-36254","description":"scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.","status":"published","published":"2021-02-25T09:15:00Z","modified":"2025-12-08T07:59:20.127901Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"}]}}