CVE-2021-41617 json
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemen…
published 5y ago modified 26d ago also EUVD-2021-28630 , JLSEC-2026-65
- cvss
- 7.0
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Patch / fix
- julia OpenSSH_jll 9.1.0+0
- openbsd openssh 8.8
- openssh Debian 14, Debian 13, Debian 12 1:8.7p1-1
debian advisories DEBIAN-CVE-2021-41617
- openssh Ubuntu 20.04 LTS 1:8.2p1-4ubuntu0.11
- openssh Ubuntu Pro 16.04 LTS 1:7.2p2-4ubuntu2.10+esm2
- openssh Ubuntu Pro FIPS-updates 16.04 LTS 1:7.2p2-4ubuntu2.fips.2.10.3
- openssh Ubuntu Pro FIPS-updates 20.04 LTS 1:8.2p1-4ubuntu0.fips.0.11
ubuntu advisories UBUNTU-CVE-2021-41617
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openssh RHEL 8 8.0p1-13.el8
- openssh-cavs RHEL 8 8.0p1-13.el8
- openssh-ldap RHEL 8 8.0p1-13.el8
- openssh-keycat RHEL 8 8.0p1-13.el8
- openssh-server RHEL 8 8.0p1-13.el8
- openssh-askpass RHEL 8 8.0p1-13.el8
- openssh-clients RHEL 8 8.0p1-13.el8
- pam_ssh_agent_auth RHEL 8 0.10.3-7.13.el8
red hat advisories RHSA-2022:2013RHSA-2021:4782
- openssh SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +8 more 8.1p1-5.21.1
- openssh-askpass-gnome SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +7 more 8.1p1-5.21.1
- openssh-openssl1 SLES 11-SECURITY 6.6p1-19.12.1
- openssh SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 7.2p2-74.60.1
- openssh-askpass-gnome SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 7.2p2-74.60.1
- openssh SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP3, SLE Micro 5.1 8.4p1-3.6.1
- openssh-askpass-gnome SLE Module for Desktop Applications 15 SP3 8.4p1-3.6.1
- openssh SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 7.9p1-6.28.1
suse advisories SUSE-SU-2022:0805-1SUSE-SU-2021:14870-1SUSE-SU-2021:3951-1SUSE-SU-2021:3950-1SUSE-SU-2021:3947-1SUSE-SU-2021:3887-1
- openssh openSUSE Tumbleweed 9.6p1-3.1
- openssh openSUSE Leap 15.3 8.4p1-3.6.1
- openssh-askpass-gnome openSUSE Leap 15.3 8.4p1-3.6.1
opensuse advisories openSUSE-SU-2024:13842-1openSUSE-SU-2021:3950-1
- openssh AlmaLinux 8 8.0p1-13.el8
- openssh-cavs AlmaLinux 8 8.0p1-13.el8
- openssh-ldap AlmaLinux 8 8.0p1-13.el8
- openssh-keycat AlmaLinux 8 8.0p1-13.el8
- openssh-server AlmaLinux 8 8.0p1-13.el8
- openssh-askpass AlmaLinux 8 8.0p1-13.el8
- openssh-clients AlmaLinux 8 8.0p1-13.el8
- pam_ssh_agent_auth AlmaLinux 8 0.10.3-7.13.el8
almalinux advisories ALSA-2022:2013
- openssh Rocky Linux 8 8.0p1-13.el8
rocky linux advisories RLSA-2022:2013
- openssh Alpine 3.11 8.1_p1-r1
- openssh Alpine 3.12 8.3_p1-r3
- openssh Alpine 3.13 8.4_p1-r4
- openssh Alpine 3.14 8.6_p1-r3
- openssh Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 8.8_p1-r0
alpine advisories ALPINE-CVE-2021-41617
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- openssh Arch Linux 8.8p1-1
arch linux advisories AVG-2422
Is CVE-2021-41617 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-41617 updated cvss 7.0
openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured
-
Red Hat Enterprise Linux 6 openssh, openssh-ldap, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_authaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass 8.0p1-13.el8 Red Hat Enterprise Linux BaseOS (v. 8) openssh 8.0p1-13.el8, openssh-cavs 8.0p1-13.el8, openssh-ldap 8.0p1-13.el8, openssh-keycat 8.0p1-13.el8, openssh-server 8.0p1-13.el8, openssh-clients 8.0p1-13.el8, +1 morefixed: vendor fix RHSA-2022:2013
-
Red Hat Enterprise Linux Client (v. 7) openssh 7.4p1-22.el7_9, openssh-keycat 7.4p1-22.el7_9, openssh-server 7.4p1-22.el7_9, openssh-askpass 7.4p1-22.el7_9, openssh-clients 7.4p1-22.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs 7.4p1-22.el7_9, openssh-ldap 7.4p1-22.el7_9, pam_ssh_agent_auth 0.10.3-2.22.el7_9, openssh-server-sysvinit 7.4p1-22.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-cavs 7.4p1-22.el7_9, openssh-ldap 7.4p1-22.el7_9, openssh-askpass 7.4p1-22.el7_9, pam_ssh_agent_auth 0.10.3-2.22.el7_9, openssh-server-sysvinit 7.4p1-22.el7_9 Red Hat Enterprise Linux Server (v. 7) openssh 7.4p1-22.el7_9, openssh-keycat 7.4p1-22.el7_9, openssh-server 7.4p1-22.el7_9, openssh-askpass 7.4p1-22.el7_9, openssh-clients 7.4p1-22.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs 7.4p1-22.el7_9, openssh-ldap 7.4p1-22.el7_9, pam_ssh_agent_auth 0.10.3-2.22.el7_9, openssh-server-sysvinit 7.4p1-22.el7_9 Red Hat Enterprise Linux Workstation (v. 7) openssh 7.4p1-22.el7_9, openssh-keycat 7.4p1-22.el7_9, openssh-server 7.4p1-22.el7_9, openssh-askpass 7.4p1-22.el7_9, openssh-clients 7.4p1-22.el7_9fixed: vendor fix RHSA-2021:4782
+1 more productsfewer
Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs 7.4p1-22.el7_9, openssh-ldap 7.4p1-22.el7_9, pam_ssh_agent_auth 0.10.3-2.22.el7_9, openssh-server-sysvinit 7.4p1-22.el7_9 -
Red Hat Enterprise Linux 9 openssh, openssh-keycat, openssh-server, openssh-askpass, openssh-clients, pam_ssh_agent_authnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-295-11 updated cvss 7.0
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.7 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.7affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-26-209-04 updated cvss 7.0
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.6 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.6affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-25-162-05 updated cvss 7.0
Siemens SIMATIC S7-1500 CPU family
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.5affected: mitigation, no fix available
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
2.55% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | OpenSSH_jll | <9.1.0+0 |
9.1.0+0 |
Affected products
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
References
-
oracle.com
/security-alerts/cpuapr2022.html
patch, third-party-advisory, web
-
bugzilla.suse.com
/show_bug.cgi?id=1190975
issue-tracking, patch, third-party-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/
vendor-advisory, web
-
debian.org
/security/2023/dsa-5586
vendor-advisory, web
-
openssh.com
/security.html
vendor-advisory, web
-
openssh.com
/txt/release-8.8
release-notes, vendor-advisory, web
-
openwall.com
/lists/oss-security/2021/09/26/1
mailing-list, third-party-advisory, web
-
security.netapp.com
/advisory/ntap-20211014-0004/
third-party-advisory, web
-
oracle.com
/security-alerts/cpujul2022.html
third-party-advisory, web
-
starwindsoftware.com
/security/sw-20220805-0001/
third-party-advisory, web
-
tenable.com
/plugins/nessus/154174
web
-
lists.debian.org
/debian-lts-announce/2023/12/msg00017.html
mailing-list, web
-
cert-portal.siemens.com
/productcert/html/ssa-082556.html
web
-
cert-portal.siemens.com
/productcert/html/ssa-019113.html
web
- cert-portal.siemens.com /productcert/html/ssa-457936.html
Sources
- CVE List CVE-2021-41617
- NVD CVE-2021-41617
- OSV JLSEC-2026-65
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.