Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2021-41617

Published: Sep 26, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
7 MODERATE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
LOW
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-41617
CWEhttps://cwe.mitre.org/data/definitions/NVD-Other.html

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Affected Software

NameVendorStart VersionEnd Version
OpensshOpenbsd6.2 (including)8.8 (excluding)
Red Hat Enterprise Linux 7RedHatopenssh-0:7.4p1-22.el7_9*
Red Hat Enterprise Linux 8RedHatopenssh-0:8.0p1-13.el8*
Red Hat Enterprise Linux 8RedHatopenssh-0:8.0p1-13.el8*
OpensshUbuntubionic*
OpensshUbuntuesm-infra-legacy/trusty*
OpensshUbuntuesm-infra/bionic*
OpensshUbuntuesm-infra/focal*
OpensshUbuntuesm-infra/xenial*
OpensshUbuntufips-updates/bionic*
OpensshUbuntufips-updates/focal*
OpensshUbuntufips-updates/xenial*
OpensshUbuntufips/bionic*
OpensshUbuntufips/focal*
OpensshUbuntufips/xenial*
OpensshUbuntufocal*
OpensshUbuntuhirsute*
OpensshUbuntuimpish*
OpensshUbuntutrusty*
OpensshUbuntutrusty/esm*
OpensshUbuntuupstream*
OpensshUbuntuxenial*
Openssh-ssh1Ubuntubionic*
Openssh-ssh1Ubuntudevel*
Openssh-ssh1Ubuntuesm-apps/bionic*
Openssh-ssh1Ubuntuesm-apps/focal*
Openssh-ssh1Ubuntuesm-apps/jammy*
Openssh-ssh1Ubuntuesm-apps/noble*
Openssh-ssh1Ubuntufocal*
Openssh-ssh1Ubuntuhirsute*
Openssh-ssh1Ubuntuimpish*
Openssh-ssh1Ubuntujammy*
Openssh-ssh1Ubuntukinetic*
Openssh-ssh1Ubuntulunar*
Openssh-ssh1Ubuntumantic*
Openssh-ssh1Ubuntunoble*
Openssh-ssh1Ubuntuoracular*
Openssh-ssh1Ubuntuplucky*
Openssh-ssh1Ubuntuquesting*
Openssh-ssh1Ubuntuupstream*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use