CVE-2021-36368

    Dashboard / Vulnerabilities / CVE-2021-36368

    CVE-2021-36368

    Published: 13 Mar 2022Last Modified: 24 Oct 2026

    Summary:

    Details: An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

    References: https://docs.ssh-mitm.at/trivialauth.html, https://security-tracker.debian.org/tracker/CVE-2021-36368, https://www.openssh.com/security.html, https://bugzilla.mindrot.org/show_bug.cgi?id=3316, https://github.com/openssh/openssh-portable/pull/258

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -166456cedad3962b83b848b1e9caf80794831f0f

    Affected versions

    V_8_8_P1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-36368 | CVE-DB