CVE-2021-41617

Note

Priority reason:
Cannot be reproduced on Ubuntu since sshd drops groups early
openssh-ssh1 is provided for compatibility with old devices that
cannot be upgraded to modern protocols. Thus we may not provide security
support for this package if doing so would prevent access to equipment.
Only applies to non-default configurations where
AuthorizedKeysCommand or AuthorizedPrincipalsCommand are used.
Cannot reproduce since sshd for all releases drops supplementary
groups early when it starts with setgroups(0, NULL).

Package	Release	Status
openssh Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Released (1:8.2p1-4ubuntu0.11)
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Not vulnerable (1:8.9p1-3)
	kinetic	Not vulnerable (1:9.0p1-1ubuntu7)
	lunar	Not vulnerable (1:9.0p1-1ubuntu7)
	mantic	Not vulnerable (1:9.0p1-1ubuntu7)
	noble	Not vulnerable (1:9.0p1-1ubuntu7)
	trusty	Needed
	upstream	Released (8.8)
	xenial	Released (1:7.2p2-4ubuntu2.10+esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	Patches: upstream: https://github.com/openssh/openssh-portable/commit/f3cbe43e28fe71427d41cfe3a17125b972710455 upstream: https://github.com/openssh/openssh-portable/commit/bf944e3794eff5413f2df1ef37cddf96918c6bde
openssh-ssh1 Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needed
	hirsute	Ignored (end of life)
	impish	Ignored (end of life)
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	lunar	Ignored (end of life, was needed)
	mantic	Ignored (end of life, was needed)
	noble	Needed
	trusty	Does not exist
	upstream	Ignored (frozen on openssh 7.5p)
	xenial	Does not exist

Parameter	Value
Base score	7.0
Attack vector	Local
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-41617

Notes

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading

Author	Note
	Priority reason: Cannot be reproduced on Ubuntu since sshd drops groups early
seth-arnold	openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment.
mdeslaur	Only applies to non-default configurations where AuthorizedKeysCommand or AuthorizedPrincipalsCommand are used.
sespiros	Cannot reproduce since sshd for all releases drops supplementary groups early when it starts with setgroups(0, NULL).