NetSight
IP …
high7.0

CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not i…

Impact

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Affected products

VendorProductAffected versions
OpenbsdOpenssh
from 6.2 before 8.8
FedoraprojectFedora
Versions 33, 34, 35
NetappActive Iq Unified Manager
All versions
NetappClustered Data Ontap
All versions
NetappHci Management Node
All versions
NetappOntap Select Deploy Administration Utility
All versions
NetappSolidfire
All versions
NetappAff A250 Firmware
All versions
NetappAff 500f Firmware
All versions
OracleHttp Server
Versions 12.2.1.2.0, 12.2.1.3.0, 12.2.1.4.0
OracleZfs Storage Appliance Kit
Version 8.8
StarwindsoftwareStarwind Virtual San
Version v8r13

References