View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2021-36368 severity not set: SUSE including 6 source package names (openssh, openssh-clients, openssh-common, openssh-fips, openssh-helpers, openssh-server), 97 product×package rows across 38 product lines (SUSE CaaS Platform 4.0, SUSE Enterprise Storage 6, … (38 product lines)): Will Not Fix 97.
An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=verbose, and an attacker has silently modified the server to support the None authentication option, then the user cannot determine whether FIDO authentication is going to confirm that the user wishes to connect to that server, or that the user wishes to allow that server to connect to a different server on the user's behalf. NOTE: the vendor's position is "this is not an authentication bypass, since nothing is being bypassed.