CVE-2021-41617
Published: 26 September 2021
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Priority
CVSS 3 base score: 7.0
Status
Package | Release | Status |
---|---|---|
openssh Launchpad, Ubuntu, Debian |
bionic |
Needed
|
focal |
Needed
|
|
hirsute |
Ignored
(reached end-of-life)
|
|
impish |
Needed
|
|
jammy |
Needed
|
|
trusty |
Needed
|
|
upstream |
Released
(8.8)
|
|
xenial |
Needed
|
|
openssh-ssh1 Launchpad, Ubuntu, Debian |
bionic |
Needed
|
focal |
Needed
|
|
hirsute |
Ignored
(reached end-of-life)
|
|
impish |
Needed
|
|
jammy |
Needed
|
|
trusty |
Does not exist
|
|
upstream |
Ignored
(frozen on openssh 7.5p)
|
|
xenial |
Does not exist
|
Notes
Author | Note |
---|---|
seth-arnold | openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment. |
mdeslaur | Only applies to non-default configurations where AuthorizedKeysCommand or AuthorizedPrincipalsCommand are used. |
sespiros | Cannot reproduce since sshd for all releases drops supplementary groups early when it starts with setgroups(0, NULL). |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41617
- https://www.openwall.com/lists/oss-security/2021/09/26/1
- https://www.openssh.com/txt/release-8.8
- https://www.openssh.com/security.html
- NVD
- Launchpad
- Debian