CVE-2021-36369

An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-side SSH code, it is possible for an SSH server to change the login process in its favor. This attack can bypass additional security measures such as FIDO2 tokens or SSH-Askpass. Thus, it allows an attacker to abuse a forwarded agent for logging on to another server unnoticed.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name	Vendor	Start Version	End Version
Dropbear_ssh	Dropbear_ssh_project	*	2020.81 (including)
Dropbear	Ubuntu	bionic	*
Dropbear	Ubuntu	devel	*
Dropbear	Ubuntu	esm-apps/bionic	*
Dropbear	Ubuntu	esm-apps/focal	*
Dropbear	Ubuntu	esm-apps/jammy	*
Dropbear	Ubuntu	esm-apps/noble	*
Dropbear	Ubuntu	esm-apps/xenial	*
Dropbear	Ubuntu	focal	*
Dropbear	Ubuntu	jammy	*
Dropbear	Ubuntu	kinetic	*
Dropbear	Ubuntu	lunar	*
Dropbear	Ubuntu	mantic	*
Dropbear	Ubuntu	noble	*
Dropbear	Ubuntu	oracular	*
Dropbear	Ubuntu	plucky	*
Dropbear	Ubuntu	questing	*
Dropbear	Ubuntu	trusty	*
Dropbear	Ubuntu	upstream	*
Dropbear	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-36369
CWE	https://cwe.mitre.org/data/definitions/287.html

Improper Authentication

Weakness

Affected Software

Potential Mitigations

References

CVE-2021-36369

Improper Authentication

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References