CVE-2021-41617
🟡 Monitoruj
Błąd w OpenSSH umożliwia eskalację uprawnień przez nieprawidłową inicjalizację grup.
CVSS
7.0
EPSS
2.5%
Exploit
none
Vendor
netapp
Opis źródłowy (NVD)
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
privilege-escalation
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.0 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 2.5% |
| Opublikowano (NVD) | 2021-09-26 19:15:07 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 22:17:12 UTC |
Referencje
- https://bugzilla.suse.com/show_bug.cgi?id=1190975 ([email protected]) [Issue Tracking, Patch, Third Party Advisory]
- https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html ([email protected])
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/ ([email protected])
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/ ([email protected])
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/ ([email protected])
- https://security.netapp.com/advisory/ntap-20211014-0004/ ([email protected]) [Third Party Advisory]
- https://www.debian.org/security/2023/dsa-5586 ([email protected])
- https://www.openssh.com/security.html ([email protected]) [Vendor Advisory]
- https://www.openssh.com/txt/release-8.8 ([email protected]) [Release Notes, Vendor Advisory]
- https://www.openwall.com/lists/oss-security/2021/09/26/1 ([email protected]) [Mailing List, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuapr2022.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujul2022.html ([email protected]) [Third Party Advisory]
- https://www.starwindsoftware.com/security/sw-20220805-0001/ ([email protected]) [Third Party Advisory]
- https://www.tenable.com/plugins/nessus/154174 ([email protected])
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)