# CVE-2021-36369: dropbear: An issue was discovered in Dropbear through 2020.81 CVE-2021-36369 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2021-36369, released October 12, 2022. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2021-36369 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0186 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 12, 2022 ## Description An issue was discovered in Dropbear through 2020.81. Due to anon-RFC-compliant check of the available authentication methods in theclient-side SSH code, it is possible for an SSH server to change the loginprocess in its favor. This attack can bypass additional security measuressuch as FIDO2 tokens or SSH-Askpass. Thus, it allows an attacker to abuse aforwarded agent for logging on to another server unnoticed. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dropbear Debian 12.15 (bookworm) | 2022.82-1 | [DEBIAN-CVE-2021-36369](https://patchblox.com/security/data/fix/linux/debian-cve-2021-36369.md) | Oct 12, 2022 | | Linux | dropbear Debian 13.5 (trixie) | 2022.82-1 | [DEBIAN-CVE-2021-36369](https://patchblox.com/security/data/fix/linux/debian-cve-2021-36369.md) | Oct 12, 2022 | | Linux | dropbear Debian 14 | 2022.82-1 | [DEBIAN-CVE-2021-36369](https://patchblox.com/security/data/fix/linux/debian-cve-2021-36369.md) | Oct 12, 2022 | | Linux | dropbear Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | [dropbear 2017.75-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-dropbear-2017.75-3ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | [dropbear 2019.78-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dropbear-2019.78-2ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | [dropbear 2020.81-5ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-dropbear-2020.81-5ubuntu0.1.md) | Dec 18, 2023 | | Linux | dropbear Ubuntu 24.10 (oracular) | 2020.81-3+deb11u1 | [dropbear 2020.81-3+deb11u1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-dropbear-2020.81-3-deb11u1.md) | Jan 16, 2026 | | Linux | dropbear Ubuntu 25.04 (plucky) | 2020.81-3+deb11u1 | [dropbear 2020.81-3+deb11u1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-dropbear-2020.81-3-deb11u1.md) | Jan 16, 2026 | | Linux | dropbear-bin Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | [dropbear-bin 2017.75-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-dropbear-bin-2017.75-3ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear-bin Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | [dropbear-bin 2019.78-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dropbear-bin-2019.78-2ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear-bin Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | [dropbear-bin 2020.81-5ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-dropbear-bin-2020.81-5ubuntu0.1.md) | Dec 18, 2023 | | Linux | dropbear-bin Ubuntu 24.10 (oracular) | 2020.81-3+deb11u1 | [dropbear-bin 2020.81-3+deb11u1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-dropbear-bin-2020.81-3-deb11u1.md) | Jan 16, 2026 | | Linux | dropbear-bin Ubuntu 25.04 (plucky) | 2020.81-3+deb11u1 | [dropbear-bin 2020.81-3+deb11u1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-dropbear-bin-2020.81-3-deb11u1.md) | Jan 16, 2026 | | Linux | dropbear-initramfs Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | [dropbear-initramfs 2017.75-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-dropbear-initramfs-2017.75-3ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear-initramfs Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | [dropbear-initramfs 2019.78-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dropbear-initramfs-2019.78-2ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear-initramfs Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | [dropbear-initramfs 2020.81-5ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-dropbear-initramfs-2020.81-5ubuntu0.1.md) | Dec 18, 2023 | | Linux | dropbear-initramfs Ubuntu 24.10 (oracular) | 2020.81-3+deb11u1 | [dropbear-initramfs 2020.81-3+deb11u1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-dropbear-initramfs-2020.81-3-deb11u1.md) | Jan 16, 2026 | | Linux | dropbear-initramfs Ubuntu 25.04 (plucky) | 2020.81-3+deb11u1 | [dropbear-initramfs 2020.81-3+deb11u1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-dropbear-initramfs-2020.81-3-deb11u1.md) | Jan 16, 2026 | | Linux | dropbear-run Ubuntu 18.04.6 LTS (bionic) | 2017.75-3ubuntu0.1~esm1 | [dropbear-run 2017.75-3ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-dropbear-run-2017.75-3ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear-run Ubuntu 20.04 LTS (focal) | 2019.78-2ubuntu0.1~esm1 | [dropbear-run 2019.78-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-dropbear-run-2019.78-2ubuntu0.1-esm1.md) | Dec 18, 2023 | | Linux | dropbear-run Ubuntu 22.04.1 LTS (jammy) | 2020.81-5ubuntu0.1 | [dropbear-run 2020.81-5ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-dropbear-run-2020.81-5ubuntu0.1.md) | Dec 18, 2023 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.