Vulnerability Name:

CVE-2021-36368

Assigned:2021-07-09
Published:2022-03-13
Updated:2022-07-01
Summary:** DISPUTED ** An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf.
Note: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed."
CVSS v3 Severity:3.7 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-287
References:Source: MITRE
Type: CNA
CVE-2021-36368

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.mindrot.org/show_bug.cgi?id=3316

Source: MISC
Type: Third Party Advisory
https://docs.ssh-mitm.at/trivialauth.html

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/openssh/openssh-portable/pull/258

Source: MISC
Type: Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-36368

Source: MISC
Type: Vendor Advisory
https://www.openssh.com/security.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openbsd:openssh:*:*:*:*:*:*:*:* (Version < 8.9)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:11.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    openbsd openssh *
    debian debian linux 9.0
    debian debian linux 10.0
    debian debian linux 11.0