Approved changes feed: RSS · Atom
cpe:2.3:a:digint:btrbk:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Digint (b428b3a5-7673-5cd4-add2-12d10dca0415) |
|---|---|
| Product | Btrbk (db027e1b-fac6-5219-a623-6409f6c4f513) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/digint/btrbk |
purl2cpe | 2026-06-01 10:12:47.809127 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-62943 |
vulnerable | 2026-10-13 12:28:41.354091 |
btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constructs allow_stream_match with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorized_keys forced command can append a trailing pipe command after a valid btrbk command prefix, bypassing the allowlist and executing arbitrary commands with the privileges of the backup-target SSH account. Deployments that do not use ssh_filter_btrbk.sh in authorized_keys are not affected. This issue is fixed in version 0.32.7.
Published: 2026-09-18T16:24:48.513Z
Updated: 2026-09-21T20:50:09.611Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38173 |
vulnerable | 2026-06-08 05:32:55.608535 |
Details available
Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.
Published: 2021-08-07T18:58:19.000Z
Updated: 2024-08-04T01:37:15.793Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.