CVE-2017-9078 - The server in Dropbear before 2017.75 might allow post-authentication
root remote code execution because of a double free in cleanup of TCP
listeners when the -a option is enabled.
CVE-2017-9079 - Dropbear before 2017.75 might allow local users to read certain files
as root, if the file has the authorized_keys file format with a
command= option. This occurs because ~/.ssh/authorized_keys is read
with root privileges and symlinks are followed.
Created dropbear tracking bugs for this issue:
Affects: epel-all [bug 1452741]
Affects: fedora-all [bug 1452740]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.