CVE-2021-36369: High severity dropbear ssh vulnerability
An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it is possible for an SSH server to change the login process in its favor. This attack can bypass additional security measures such as FIDO2 tokens or SSH-Askpass. Thus, it allows an attacker to abuse a forwarded agent for logging on to another server unnoticed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36369?
CVE-2021-36369 is considered to have a medium severity due to its potential to bypass authentication in SSH sessions.
How do I fix CVE-2021-36369?
To mitigate CVE-2021-36369, update Dropbear SSH to version 2022.82 or later.
Which versions of Dropbear SSH are affected by CVE-2021-36369?
Dropbear SSH versions up to and including 2020.81 are affected by CVE-2021-36369.
What kind of systems are impacted by CVE-2021-36369?
CVE-2021-36369 affects systems using Dropbear SSH, particularly versions prior to 2022.82 and Debian GNU/Linux version 10.0.
What does CVE-2021-36369 exploit in Dropbear SSH?
CVE-2021-36369 exploits a non-RFC-compliant validation of authentication methods in the client-side SSH code.