CVEvulnerability

CVE-2021-41617

7.0 HIGH Published 2021-09-26 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2021-09-26
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P

Description

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Affected configurations

• openbsd openssh (>= 6.2 < 8.8) • fedoraproject fedora 33 • fedoraproject fedora 34 • fedoraproject fedora 35 • netapp active iq unified manager • netapp clustered data ontap • netapp hci management node • netapp ontap select deploy administration utility • netapp solidfire • netapp aff a250 firmware • netapp aff 500f firmware • oracle http server 12.2.1.2.0 • oracle http server 12.2.1.3.0 • oracle http server 12.2.1.4.0 • oracle zfs storage appliance kit 8.8 • starwindsoftware starwind virtual san v8r13

References