PT-2021-21982 · Btrbk · Btrbk

Protree · Published 2021-08-07 · Updated 2022-03-25 · CVE-2021-38173

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Btrbk versions prior to 0.31.2

Description: The issue allows command execution due to the mishandling of remote hosts filtering SSH commands using ssh filter btrbk.sh in authorized keys.

Recommendations: For versions prior to 0.31.2, update to version 0.31.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ssh filter btrbk.sh script in authorized keys until the update is applied.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-38173

DLA-2755-1

Affected Products

Btrbk

References · 15

• https://github.com/digint/btrbk/commit/58212de771c381cd4fa05625927080bf264e9584 · Patch
• https://osv.dev/vulnerability/DLA-2755-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP2T32JMENJFRP2HWXR7FTTZVRTTPECL · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38173 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38173 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38173 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38173 · Security Note
• https://ubuntu.com/security/CVE-2021-38173 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM7GLTUN5YS4KE2RNBX732EAMVVGNEX3 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38173 · Security Note
• https://github.com/digint/btrbk/blob/master/ChangeLog · Note
• https://lists.debian.org/debian-lts-announce/2021/09/msg00002.html · Note
• https://t.me/cvenotify/18851 · Telegram Post
• https://t.me/cvenotify/20682 · Telegram Post