CVE-2021-38173
9.8
CRITICAL · CVSS 3.1 · EPSS 3.2% (pctl 88)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.16% — more likely to be exploited than 88% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-08-07 |
| Last modified | 2026-06-17 |
Affected (3)
| Vendor | Product |
|---|---|
| debian | debian linux |
| digint | btrbk |
| fedoraproject | fedora |
References
- https://github.com/digint/btrbk/blob/master/ChangeLog
- https://github.com/digint/btrbk/commit/58212de771c381cd4fa05625927080bf264e9584
- https://lists.debian.org/debian-lts-announce/2021/09/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP2T32JMENJFRP2HWXR7FTTZVRTTPECL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM7GLTUN5YS4KE2RNBX732EAMVVGNEX3/
- https://github.com/digint/btrbk/blob/master/ChangeLog
- https://github.com/digint/btrbk/commit/58212de771c381cd4fa05625927080bf264e9584
- https://lists.debian.org/debian-lts-announce/2021/09/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP2T32JMENJFRP2HWXR7FTTZVRTTPECL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM7GLTUN5YS4KE2RNBX732EAMVVGNEX3/
→ the Explorer · watch your stack · NVD