Is CVE-2021-41617 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 2%.

What products does CVE-2021-41617 affect?

Tracked products affected include OpenSSH. Check the version you run to see whether it is affected.

How do I fix CVE-2021-41617?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2021-41617

Q: What is CVE-2021-41617?

CVE-2021-41617 is a high-severity software vulnerability with a CVSS score of 7. sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedP

HIGH severity · CVSS 7

7CVSS HIGH

Summary

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Impact & exploitability

Attack vectorLocal

Attack complexityHigh

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)2%

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

OpenSSH

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://bugzilla.suse.com/show_bug.cgi?id=1190975 ↗

Additional information

NVD record
https://bugzilla.suse.com/show_bug.cgi?id=1190975Patch
https://www.openssh.com/security.htmlAdvisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/
https://security.netapp.com/advisory/ntap-20211014-0004/Advisory
https://www.debian.org/security/2023/dsa-5586