dropbear: An issue was discovered in Dropbear through 2020.81
CVE-2021-36369 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2021-36369, released October 12, 2022. It is not reported as exploited. Patch Radar priority: High.
An issue was discovered in Dropbear through 2020.81. Due to anon-RFC-compliant check of the available authentication methods in theclient-side SSH code, it is possible for an SSH server to change the loginprocess in its favor. This attack can bypass additional security measuressuch as FIDO2 tokens or SSH-Askpass. Thus, it allows an attacker to abuse aforwarded agent for logging on to another server unnoticed.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| dropbear · Debian 12.15 (bookworm) | 2022.82-1 | DEBIAN-CVE-2021-36369 | Oct 12, 2022 |
| dropbear · Debian 13.5 (trixie) | 2022.82-1 | DEBIAN-CVE-2021-36369 | Oct 12, 2022 |
| dropbear · Debian 14 | 2022.82-1 | DEBIAN-CVE-2021-36369 | Oct 12, 2022 |
| dropbear · Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | dropbear 2017.75-3ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear · Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | dropbear 2019.78-2ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear · Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | dropbear 2020.81-5ubuntu0.1 | Dec 18, 2023 |
| dropbear · Ubuntu 24.10 (oracular) | 2020.81-3+deb11u1 | dropbear 2020.81-3+deb11u1 | Jan 16, 2026 |
| dropbear · Ubuntu 25.04 (plucky) | 2020.81-3+deb11u1 | dropbear 2020.81-3+deb11u1 | Jan 16, 2026 |
| dropbear-bin · Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | dropbear-bin 2017.75-3ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear-bin · Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | dropbear-bin 2019.78-2ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear-bin · Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | dropbear-bin 2020.81-5ubuntu0.1 | Dec 18, 2023 |
| dropbear-bin · Ubuntu 24.10 (oracular) | 2020.81-3+deb11u1 | dropbear-bin 2020.81-3+deb11u1 | Jan 16, 2026 |
| dropbear-bin · Ubuntu 25.04 (plucky) | 2020.81-3+deb11u1 | dropbear-bin 2020.81-3+deb11u1 | Jan 16, 2026 |
| dropbear-initramfs · Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | dropbear-initramfs 2017.75-3ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear-initramfs · Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | dropbear-initramfs 2019.78-2ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear-initramfs · Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | dropbear-initramfs 2020.81-5ubuntu0.1 | Dec 18, 2023 |
| dropbear-initramfs · Ubuntu 24.10 (oracular) | 2020.81-3+deb11u1 | dropbear-initramfs 2020.81-3+deb11u1 | Jan 16, 2026 |
| dropbear-initramfs · Ubuntu 25.04 (plucky) | 2020.81-3+deb11u1 | dropbear-initramfs 2020.81-3+deb11u1 | Jan 16, 2026 |
| dropbear-run · Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | dropbear-run 2017.75-3ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear-run · Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | dropbear-run 2019.78-2ubuntu0.1~esm1 | Dec 18, 2023 |
| dropbear-run · Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | dropbear-run 2020.81-5ubuntu0.1 | Dec 18, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.