CVE-2021-36368

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Mar 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-363697.5An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-CVE-2021-36377.5A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessiCVE-2021-363707.5An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neitherCVE-2021-363713.7Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cerCVE-2021-363729.8In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with aCVE-2021-363735.5When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an ouCVE-2021-363745.5When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory thatCVE-2021-363767.8dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.CVE-2021-363777.5Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.CVE-2021-36386.5An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while haCVE-2021-363809.8Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiaCVE-2021-363815.3In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?