Remote Command Execution Vulnerability in Btrbk Product by Digint
CVE-2021-38173

9.8CRITICAL

Key Information:

Vendor

Digint

Status
Btrbk
Vendor
CVE Published:
7 August 2021

What is CVE-2021-38173?

Btrbk versions prior to 0.31.2 are susceptible to a remote command execution vulnerability due to improper filtering of SSH commands via the ssh_filter_btrbk.sh script within authorized_keys. This flaw could allow an attacker to execute arbitrary commands on the affected system by manipulating SSH keys. It is crucial for users of Btrbk to upgrade to the latest version to mitigate potential security risks.

References

https://github.com/digint/btrbk/commit/58212de771c381cd4f...
x_refsource_MISC
https://github.com/digint/btrbk/blob/master/ChangeLog
x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2021/09/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.