An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent     forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the     None authentication option, then the user cannot determine whether FIDO authentication is going to confirm     that the user wishes to connect to that server, or that the user wishes to allow that server to connect to     a different server on the user's behalf. NOTE: the vendor's position is 'this is not an authentication     bypass, since nothing is being bypassed.(CVE-2021-36368)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssh security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent     forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the     None authentication option, then the user cannot determine whether FIDO authentication is going to confirm     that the user wishes to connect to that server, or that the user wishes to allow that server to connect to     a different server on the user's behalf. NOTE: the vendor's position is 'this is not an authentication     bypass, since nothing is being bypassed.(CVE-2021-36368)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** An issue was discovered in OpenSSH before 8.9. If a client is using public-key     authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified     the server to support the None authentication option, then the user cannot determine whether FIDO     authentication is going to confirm that the user wishes to connect to that server, or that the user wishes     to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is     'this is not an authentication bypass, since nothing is being bypassed.' (CVE-2021-36368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** An issue was discovered in OpenSSH before 8.9. If a client is using public-key     authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified     the server to support the None authentication option, then the user cannot determine whether FIDO     authentication is going to confirm that the user wishes to connect to that server, or that the user wishes     to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is     'this is not an authentication bypass, since nothing is being bypassed.' (CVE-2021-36368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of OpenSSH running on the remote host is potentially affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206544	EulerOS Virtualization 2.12.1 : openssh (EulerOS-SA-2024-2313)	Nessus	Huawei Local Security Checks	low
206530	EulerOS Virtualization 2.12.0 : openssh (EulerOS-SA-2024-2333)	Nessus	Huawei Local Security Checks	low
205945	EulerOS 2.0 SP12 : openssh (EulerOS-SA-2024-2246)	Nessus	Huawei Local Security Checks	low
205932	EulerOS 2.0 SP12 : openssh (EulerOS-SA-2024-2222)	Nessus	Huawei Local Security Checks	low
165397	EulerOS Virtualization 2.9.1 : openssh (EulerOS-SA-2022-2359)	Nessus	Huawei Local Security Checks	low
165368	EulerOS Virtualization 2.9.0 : openssh (EulerOS-SA-2022-2395)	Nessus	Huawei Local Security Checks	low
163569	EulerOS 2.0 SP10 : openssh (EulerOS-SA-2022-2167)	Nessus	Huawei Local Security Checks	low
163551	EulerOS 2.0 SP10 : openssh (EulerOS-SA-2022-2142)	Nessus	Huawei Local Security Checks	low
163211	EulerOS Virtualization 2.10.0 : openssh (EulerOS-SA-2022-2097)	Nessus	Huawei Local Security Checks	low
163124	EulerOS Virtualization 2.10.1 : openssh (EulerOS-SA-2022-2117)	Nessus	Huawei Local Security Checks	low
162909	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2022-2006)	Nessus	Huawei Local Security Checks	low
162897	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2022-1976)	Nessus	Huawei Local Security Checks	low
159492	OpenSSH PCI Disputed Vulnerabilities.	Nessus	Misc.	high

Detections

Analytics

CVE-2021-36368

low

Tenable Plugins

low

low

low

low

low

low

low

low

low

low

low

low

high