UBUNTU-CVE-2021-41617

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2021-41617

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-41617.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-41617

Related

Published

2021-09-26T19:15:00Z

Modified

2024-11-20T12:20:04Z

Severity

7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

References

Affected packages

Ubuntu:Pro:14.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:6.*

1:6.2p2-6

1:6.2p2-6ubuntu1

1:6.4p1-1

1:6.4p1-2

1:6.5p1-1

1:6.5p1-2

1:6.5p1-3

1:6.5p1-4

1:6.5p1-6

1:6.6p1-1

1:6.6p1-2

1:6.6p1-2ubuntu1

1:6.6p1-2ubuntu2

1:6.6p1-2ubuntu2.2

1:6.6p1-2ubuntu2.3

1:6.6p1-2ubuntu2.4

1:6.6p1-2ubuntu2.6

1:6.6p1-2ubuntu2.7

1:6.6p1-2ubuntu2.8

1:6.6p1-2ubuntu2.10

1:6.6p1-2ubuntu2.11

1:6.6p1-2ubuntu2.12

1:6.6p1-2ubuntu2.13

1:6.6p1-2ubuntu2.13+esm1

1:6.6p1-2ubuntu2.13+esm2

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:16.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:7.2p2-4ubuntu2.10+esm2

Affected versions

1:6.*

1:6.9p1-2

1:6.9p1-3

1:7.*

1:7.1p1-1

1:7.1p1-3

1:7.1p1-4

1:7.1p1-6

1:7.1p2-1

1:7.1p2-2

1:7.2p1-1

1:7.2p2-1

1:7.2p2-2

1:7.2p2-3

1:7.2p2-4

1:7.2p2-4ubuntu1

1:7.2p2-4ubuntu2.1

1:7.2p2-4ubuntu2.2

1:7.2p2-4ubuntu2.4

1:7.2p2-4ubuntu2.5

1:7.2p2-4ubuntu2.6

1:7.2p2-4ubuntu2.7

1:7.2p2-4ubuntu2.8

1:7.2p2-4ubuntu2.10

1:7.2p2-4ubuntu2.10+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-client"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-client-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-client-ssh1"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-client-ssh1-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-client-udeb"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-client-udeb-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-server"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-server-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-server-udeb"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-server-udeb-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-sftp-server"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "openssh-sftp-server-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "ssh"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "ssh-askpass-gnome"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "ssh-askpass-gnome-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.10+esm2",
            "binary_name": "ssh-krb5"
        }
    ],
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:FIPS:16.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=fips-updates/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:7.2p2-4ubuntu2.fips.2.10.3

Affected versions

1:7.*

1:7.2p2-4ubuntu2.fips.2.2.3

1:7.2p2-4ubuntu2.fips.2.4.1

1:7.2p2-4ubuntu2.fips.2.4.2

1:7.2p2-4ubuntu2.fips.2.8.1

1:7.2p2-4ubuntu2.fips.2.10.1

1:7.2p2-4ubuntu2.fips.2.10.2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client-hmac"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client-ssh1"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client-ssh1-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client-udeb"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-client-udeb-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-server"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-server-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-server-hmac"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-server-udeb"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-server-udeb-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-sftp-server"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "openssh-sftp-server-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "ssh"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "ssh-askpass-gnome"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "ssh-askpass-gnome-dbgsym"
        },
        {
            "binary_version": "1:7.2p2-4ubuntu2.fips.2.10.3",
            "binary_name": "ssh-krb5"
        }
    ],
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:FIPS:16.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=fips/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.2p2-4ubuntu2.fips.2.2

1:7.2p2-4ubuntu2.fips.2.2.1

1:7.2p2-4ubuntu2.fips.2.10.1

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:18.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-10

1:7.6p1-4

1:7.6p1-4ubuntu0.1

1:7.6p1-4ubuntu0.2

1:7.6p1-4ubuntu0.3

1:7.6p1-4ubuntu0.5

1:7.6p1-4ubuntu0.6

1:7.6p1-4ubuntu0.7

1:7.6p1-4ubuntu0.7+esm1

1:7.6p1-4ubuntu0.7+esm2

1:7.6p1-4ubuntu0.7+esm3

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:18.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1
Purl: pkg:deb/ubuntu/openssh-ssh1?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-8

1:7.5p1-9

1:7.5p1-9build1

1:7.5p1-10

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:FIPS-updates:18.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=fips-updates/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.9p1-10~ubuntu18.04.fips.0.1

1:7.9p1-10~ubuntu18.04.fips.0.2

1:7.9p1-10~ubuntu18.04.fips.0.3

1:7.9p1-10~ubuntu18.04.fips.0.4

1:7.9p1-10~ubuntu18.04.fips.0.5

1:7.9p1-10~ubuntu18.04.fips.0.6

1:7.9p1-10~ubuntu18.04.fips.0.7

1:7.9p1-10~ubuntu18.04.fips.0.8

1:7.9p1-10~ubuntu18.04.fips.0.9

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:FIPS:18.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=fips/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.9p1-10~ubuntu18.04.fips.0.1

1:7.9p1-10~ubuntu18.04.fips.0.2

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:20.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:8.2p1-4ubuntu0.11

Affected versions

1:8.*

1:8.0p1-6build1

1:8.1p1-1

1:8.1p1-5

1:8.2p1-4

1:8.2p1-4ubuntu0.1

1:8.2p1-4ubuntu0.2

1:8.2p1-4ubuntu0.3

1:8.2p1-4ubuntu0.4

1:8.2p1-4ubuntu0.5

1:8.2p1-4ubuntu0.7

1:8.2p1-4ubuntu0.8

1:8.2p1-4ubuntu0.9

1:8.2p1-4ubuntu0.10

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-client"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-client-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-client-udeb"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-server"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-server-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-server-udeb"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-sftp-server"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-sftp-server-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-tests"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "openssh-tests-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "ssh"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "ssh-askpass-gnome"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.11",
            "binary_name": "ssh-askpass-gnome-dbgsym"
        }
    ],
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:20.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1
Purl: pkg:deb/ubuntu/openssh-ssh1?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-11build1

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:FIPS-updates:20.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=fips-updates/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:8.2p1-4ubuntu0.fips.0.11

Affected versions

1:8.*

1:8.2p1-4ubuntu0.fips.0.2.1

1:8.2p1-4ubuntu0.fips.0.4.0

1:8.2p1-4ubuntu0.fips.0.5.0

1:8.2p1-4ubuntu0.fips.0.7

1:8.2p1-4ubuntu0.fips.0.8

1:8.2p1-4ubuntu0.fips.0.9

1:8.2p1-4ubuntu0.fips.0.10

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-client"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-client-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-client-udeb"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-server"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-server-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-server-udeb"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-sftp-server"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-sftp-server-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-tests"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "openssh-tests-dbgsym"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "ssh"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "ssh-askpass-gnome"
        },
        {
            "binary_version": "1:8.2p1-4ubuntu0.fips.0.11",
            "binary_name": "ssh-askpass-gnome-dbgsym"
        }
    ],
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:Pro:FIPS:20.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=fips/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:8.*

1:8.2p1-4ubuntu0.fips.0.2.1

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:22.04:LTS / openssh

Package

Name: openssh
Purl: pkg:deb/ubuntu/openssh?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:8.9p1-3

Affected versions

1:8.*

1:8.4p1-6ubuntu2

1:8.7p1-2

1:8.7p1-2build1

1:8.7p1-4

1:8.8p1-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-client"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-client-dbgsym"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-server"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-server-dbgsym"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-sftp-server"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-sftp-server-dbgsym"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-tests"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "openssh-tests-dbgsym"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "ssh"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "ssh-askpass-gnome"
        },
        {
            "binary_version": "1:8.9p1-3",
            "binary_name": "ssh-askpass-gnome-dbgsym"
        }
    ],
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:22.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1
Purl: pkg:deb/ubuntu/openssh-ssh1?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-12

1:7.5p1-12build1

1:7.5p1-13

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:24.10 / openssh-ssh1

Package

Name: openssh-ssh1
Purl: pkg:deb/ubuntu/openssh-ssh1?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-16

1:7.5p1-17

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}

Ubuntu:24.04:LTS / openssh-ssh1

Package

Name: openssh-ssh1
Purl: pkg:deb/ubuntu/openssh-ssh1?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:7.*

1:7.5p1-14

1:7.5p1-15

1:7.5p1-15build1

1:7.5p1-16

Ecosystem specific

{
    "ubuntu_priority": "low",
    "priority_reason": "Cannot be reproduced on Ubuntu since sshd drops groups early"
}