CVE-2021-36368: Low severity OpenBSD OpenSSH vulnerability
DISPUTED An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-36368?
CVE-2021-36368 is a vulnerability in OpenSSH before version 8.9 that allows an attacker to silently modify the server and potentially bypass public-key authentication.
Which software is affected by CVE-2021-36368?
OpenSSH versions up to 8.9 and Debian Linux versions 9.0, 10.0, and 11.0 are affected by CVE-2021-36368.
What is the severity of CVE-2021-36368?
CVE-2021-36368 has a low severity rating with a CVSS score of 3.7.
How can I fix CVE-2021-36368?
To fix CVE-2021-36368, update OpenSSH to version 8.9 or higher and update Debian Linux packages to the specified versions.
Where can I find more information about CVE-2021-36368?
More information about CVE-2021-36368 can be found on the bugzilla.mindrot.org and docs.ssh-mitm.at websites, as well as on the openssh-portable GitHub repository.