CVE-2021-36368
First published: Sun Mar 13 2022(Updated: )
** DISPUTED ** An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openbsd Openssh | <8.9 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| debian/openssh | <=1:7.9p1-10+deb10u2<=1:7.9p1-10+deb10u4<=1:8.4p1-5+deb11u3 | 1:9.2p1-2+deb12u2 1:9.7p1-5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-36368?
CVE-2021-36368 is a vulnerability in OpenSSH before version 8.9 that allows an attacker to silently modify the server and potentially bypass public-key authentication.
Which software is affected by CVE-2021-36368?
OpenSSH versions up to 8.9 and Debian Linux versions 9.0, 10.0, and 11.0 are affected by CVE-2021-36368.
What is the severity of CVE-2021-36368?
CVE-2021-36368 has a low severity rating with a CVSS score of 3.7.
How can I fix CVE-2021-36368?
To fix CVE-2021-36368, update OpenSSH to version 8.9 or higher and update Debian Linux packages to the specified versions.
Where can I find more information about CVE-2021-36368?
More information about CVE-2021-36368 can be found on the bugzilla.mindrot.org and docs.ssh-mitm.at websites, as well as on the openssh-portable GitHub repository.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/security-tracker-debian
- source/Debian
- agent/severity
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/status
- agent/tags
- agent/description
- agent/event
- status/disputed
- vendor/openbsd
- canonical/openbsd openssh
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/debian