CVE-2021-41617
openssh - security update
7.0
HIGH
CVSS 3.1
EPSS 0.27%
Description
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
How to fix CVE-2021-41617
To remediate CVE-2021-41617, upgrade the affected package to a fixed version below.
- —upgrade to 8.1_p1-r1 or later
- —upgrade to 1:8.4p1-5+deb11u3 or later
- —upgrade to 1:7.9p1-10+deb10u4 or later
Is CVE-2021-41617 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 8.1_p1-r1
- from 0, < 1:8.4p1-5+deb11u3
- from 0, < 1:7.9p1-10+deb10u4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |