There is this write-up/fancy page from the person who found the vulnerability[0] (HN discussion[1], how I found this thread).

At the bottom of that it says dropbear is unaffected.

> on debian, ubuntu, fedora or anything else with glibc? going through pam? dropbear? openbsd? you're fine

[0] https://sshhole.com/

[1] https://news.ycombinator.com/item?id=50378228