A dropbear security update has been released for Debian GNU/Linux 10 LTS to address an issue what allows an attacker to bypass additional security measures such as FIDO2 tokens or SSH-Askpass.

DLA 3187-1: dropbear security update

- -----------------------------------------------------------------------
Debian LTS Advisory DLA-3187-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Utkarsh Gupta
November 14, 2022   https://wiki.debian.org/LTS
- -----------------------------------------------------------------------

Package : dropbear
Version : 2018.76-5+deb10u2
CVE ID : CVE-2021-36369

An issue was discovered in Dropbear, a relatively small SSH server and
client. Due to a non-RFC-compliant check of the available authentication
methods in the client-side SSH code, it was possible for an SSH server
to change the login process in its favor. This attack can bypass
additional security measures such as FIDO2 tokens or SSH-Askpass. Thus,
it allows an attacker to abuse a forwarded agent for logging on to
another server unnoticed.

For Debian 10 buster, this problem has been fixed in version
2018.76-5+deb10u2.

We recommend that you upgrade your dropbear packages.

For the detailed security status of dropbear please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/dropbear

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS