Your submission was sent successfully! Close

CVE-2021-41617

Published: 26 September 2021

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Priority

Low

CVSS 3 base score: 7.0

Status

Package Release Status
openssh
Launchpad, Ubuntu, Debian
bionic Needed

focal Needed

hirsute Ignored
(reached end-of-life)
impish Needed

jammy Needed

trusty Needed

upstream
Released (8.8)
xenial Needed

openssh-ssh1
Launchpad, Ubuntu, Debian
bionic Needed

focal Needed

hirsute Ignored
(reached end-of-life)
impish Needed

jammy Needed

trusty Does not exist

upstream Ignored
(frozen on openssh 7.5p)
xenial Does not exist

Notes

AuthorNote
seth-arnold
openssh-ssh1 is provided for compatibility with old devices that
cannot be upgraded to modern protocols. Thus we may not provide security
support for this package if doing so would prevent access to equipment.
mdeslaur
Only applies to non-default configurations where
AuthorizedKeysCommand or AuthorizedPrincipalsCommand are used.
sespiros
Cannot reproduce since sshd for all releases drops supplementary
groups early when it starts with setgroups(0, NULL).

References

Bugs