CVE-2021-41617

Published Sep 26, 2021

Last updated 13 days ago

Overview

Description
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Source
cve@mitre.org
NVD status
Modified
Products
openssh, fedora, active_iq_unified_manager, clustered_data_ontap, hci_management_node, ontap_select_deploy_administration_utility, solidfire, aff_a250_firmware, aff_500f_firmware, http_server, zfs_storage_appliance_kit, starwind_virtual_san

Risk scores

CVSS 3.1

Type
Primary
Base score
7
Impact score
5.9
Exploitability score
1
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
4.4
Impact score
6.4
Exploitability score
3.4
Vector string
AV:L/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
NVD-CWE-Other

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.