sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are…
Priority LOW 38Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 9 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02545 85th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 9 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* | 6.2 to before 8.8 | Vulnerable | OpenBSD |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* Versions 6.2 to before 8.8 Vulnerable ·OpenBSD
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:* | 12.2.1.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
| cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8r13:14398:*:*:*:*:*:* | v8r13 14398 | Vulnerable | Starwindsoftware |
- cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:* Versions 12.2.1.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
- cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8r13:14398:*:*:*:*:*:* Versions v8r13 14398 Vulnerable ·Starwindsoftware
Remediation
Red Hat 2 advisories
- RHSA-2022:2013 Released 2022-05-10 · Red Hat rating Moderateopenssh security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass-8.0p1-13.el8
- Red Hat Enterprise Linux BaseOS (v. 8) openssh-8.0p1-13.el8, openssh-cavs-8.0p1-13.el8, openssh-clients-8.0p1-13.el8 +4
- RHSA-2021:4782 Released 2021-11-23 · Red Hat rating Moderateopenssh security update
- Red Hat Enterprise Linux Client (v. 7) openssh-7.4p1-22.el7_9, openssh-askpass-7.4p1-22.el7_9, openssh-clients-7.4p1-22.el7_9 +2
- Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs-7.4p1-22.el7_9, openssh-ldap-7.4p1-22.el7_9, openssh-server-sysvinit-7.4p1-22.el7_9 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-askpass-7.4p1-22.el7_9, openssh-cavs-7.4p1-22.el7_9, openssh-ldap-7.4p1-22.el7_9 +2
- Red Hat Enterprise Linux Server (v. 7) openssh-7.4p1-22.el7_9, openssh-askpass-7.4p1-22.el7_9, openssh-clients-7.4p1-22.el7_9 +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs-7.4p1-22.el7_9, openssh-ldap-7.4p1-22.el7_9, openssh-server-sysvinit-7.4p1-22.el7_9 +2
- Red Hat Enterprise Linux Workstation (v. 7) openssh-7.4p1-22.el7_9, openssh-askpass-7.4p1-22.el7_9, openssh-clients-7.4p1-22.el7_9 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs-7.4p1-22.el7_9, openssh-ldap-7.4p1-22.el7_9, openssh-server-sysvinit-7.4p1-22.el7_9 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:2013 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:2013 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2021:4782 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2021:4782 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2021:4782 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:4782 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2021:4782 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:4782 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2021:4782 |
Not affected: 1 product
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41617
- 2026-10-03 Alias added: GHSA-mxh4-p4w6-g844
- 2026-10-08 CISA SSVC decision points changed
References
Patch 2
Advisory 10
- https://www.openssh.com/security.html
- https://www.openwall.com/lists/oss-security/2021/09/26/1
- https://www.openssh.com/txt/release-8.8
- FEDORA-2021-1f7339271d
- FEDORA-2021-f8df0f8563
- FEDORA-2021-fa0e94198f
- https://security.netapp.com/advisory/ntap-20211014-0004/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.starwindsoftware.com/security/sw-20220805-0001/
- DSA-5586
Sources
- CVE-2021-41617 · CVE Program
- CVE-2021-41617 · NVD
- FIRST EPSS
- GHSA-mxh4-p4w6-g844 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41617 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences