Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Published

2021-09-26T19:15:07.263

Last Modified

2024-11-21T06:26:32.077

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.0 (HIGH)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

3.4

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openbsd openssh < 8.8 Yes
Operating System fedoraproject fedora 33 Yes
Operating System fedoraproject fedora 34 Yes
Operating System fedoraproject fedora 35 Yes
Application netapp active_iq_unified_manager - Yes
Application netapp clustered_data_ontap - Yes
Application netapp hci_management_node - Yes
Application netapp ontap_select_deploy_administration_utility - Yes
Application netapp solidfire - Yes
Operating System netapp aff_a250_firmware - Yes
Hardware netapp aff_a250 - No
Operating System netapp aff_500f_firmware - Yes
Hardware netapp aff_500f - No
Application oracle http_server 12.2.1.2.0 Yes
Application oracle http_server 12.2.1.3.0 Yes
Application oracle http_server 12.2.1.4.0 Yes
Application oracle zfs_storage_appliance_kit 8.8 Yes
Application starwindsoftware starwind_virtual_san v8r13 Yes
References