ALINUX2-SA-2021%3A0066

ALINUX2-SA-2021%3A0066 PUBLISHED CVSS 7 HIGH

Package updates are available for Alibaba Cloud Linux 2.1903 that fix the following vulnerabilities: CVE-2021-41617: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Risk Scores

CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Alibaba Cloud	openssh

Timeline

Nov 24, 2021 CVE Published
Nov 24, 2021 CVE Updated

References

ALINUX2-SA-2021:0066: openssh security update (Moderate) advisory
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41617 advisory

Open in Interactive Console →