CVE-2021-36368
Summary
| CVE | CVE-2021-36368 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-03-13 00:15:07 UTC |
| Updated | 2026-05-29 20:16:20 UTC |
| Description | An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed. |
Risk And Classification
Primary CVSS: v3.1 3.7 LOW from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.004320000 probability, percentile 0.630060000 (date 2026-06-03)
Problem Types: CWE-287 | n/a | CWE-287 CWE-287 Improper Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | ADP | DECLARED | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 2.0 | [email protected] | Primary | 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:H/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Openbsd | Openssh | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 3316 – possible bypass of fido 2 devices and ssh-askpass | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mindrot.org | Issue Tracking, Third Party Advisory |
| CVE-2021-36368 | af854a3a-2127-422b-91ae-364da2661108 | security-tracker.debian.org | Third Party Advisory |
| OpenSSH: Security | af854a3a-2127-422b-91ae-364da2661108 | www.openssh.com | Vendor Advisory |
| SSH-MITM Docs - Trivial Authentication | af854a3a-2127-422b-91ae-364da2661108 | docs.ssh-mitm.at | Third Party Advisory |
| CVE-2021-36368 - added option to disable trivial auth methods by manfred-kaiser · Pull Request #258 · openssh/openssh-portable · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 183825 Debian Security Update for openssh (CVE-2021-36368)
- 38900 OpenSSH Public-Key Authentication Vulnerability
- 671904 EulerOS Security Update for openssh (EulerOS-SA-2022-1976)
- 671948 EulerOS Security Update for openssh (EulerOS-SA-2022-2006)
- 671973 EulerOS Security Update for openssh (EulerOS-SA-2022-2167)
- 672011 EulerOS Security Update for openssh (EulerOS-SA-2022-2142)
- 900760 Common Base Linux Mariner (CBL-Mariner) Security Update for openssh (9042)
- 900947 Common Base Linux Mariner (CBL-Mariner) Security Update for openssh (9045)
- 904378 Common Base Linux Mariner (CBL-Mariner) Security Update for openssh (9042-1)
- 907199 Common Base Linux Mariner (CBL-Mariner) Security Update for openssh (9045-1)