CVE-2021-41617

NameCVE-2021-41617
Descriptionsshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3694-1, ELA-1038-1, ELA-1055-1
Debian Bugs995130

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openssh (PTS)jessie, jessie (lts)1:6.7p1-5+deb8u10fixed
stretch (security)1:7.4p1-10+deb9u6vulnerable
stretch (lts), stretch1:7.4p1-10+deb9u9fixed
buster1:7.9p1-10+deb10u2vulnerable
buster (security)1:7.9p1-10+deb10u4fixed
bullseye (security), bullseye1:8.4p1-5+deb11u3fixed
bookworm (security), bookworm1:9.2p1-2+deb12u2fixed
sid, trixie1:9.7p1-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opensshsourcejessie1:6.7p1-5+deb8u10ELA-1055-1
opensshsourcestretch1:7.4p1-10+deb9u9ELA-1038-1
opensshsourcebuster1:7.9p1-10+deb10u4DLA-3694-1
opensshsourcebullseye1:8.4p1-5+deb11u3
opensshsource(unstable)1:8.7p1-1995130

Notes

[stretch] - openssh <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2021/09/26/1
https://github.com/openssh/openssh-portable/commit/f3cbe43e28fe71427d41cfe3a17125b972710455
https://github.com/openssh/openssh-portable/commit/bf944e3794eff5413f2df1ef37cddf96918c6bde

Search for package or bug name: Reporting problems