sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-opensshalma-upgrade-openssh-askpassalma-upgrade-openssh-cavsalma-upgrade-openssh-clientsalma-upgrade-openssh-keycatalma-upgrade-openssh-ldapalma-upgrade-openssh-serveralma-upgrade-pam_ssh_agent_auth | May 13, 2022 | Sep 26, 2021 | |
| Alpine Linux | alpine-linux-upgrade-openssh | Mar 26, 2024 | Sep 26, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-opensshamazon-linux-ami-2-upgrade-openssh-askpassamazon-linux-ami-2-upgrade-openssh-cavsamazon-linux-ami-2-upgrade-openssh-clientsamazon-linux-ami-2-upgrade-openssh-debuginfoamazon-linux-ami-2-upgrade-openssh-keycatamazon-linux-ami-2-upgrade-openssh-ldapamazon-linux-ami-2-upgrade-openssh-serveramazon-linux-ami-2-upgrade-openssh-server-sysvinitamazon-linux-ami-2-upgrade-pam_ssh_agent_auth | Jul 4, 2022 | Sep 26, 2021 | |
| Amazon_linux | — | amazon-linux-upgrade-openssh | Feb 19, 2022 | Sep 26, 2021 |
| Centos_linux | — | centos-upgrade-opensshcentos-upgrade-openssh-askpasscentos-upgrade-openssh-askpass-debuginfocentos-upgrade-openssh-cavscentos-upgrade-openssh-cavs-debuginfocentos-upgrade-openssh-clientscentos-upgrade-openssh-clients-debuginfocentos-upgrade-openssh-debuginfocentos-upgrade-openssh-debugsourcecentos-upgrade-openssh-keycatcentos-upgrade-openssh-keycat-debuginfocentos-upgrade-openssh-ldapcentos-upgrade-openssh-ldap-debuginfocentos-upgrade-openssh-servercentos-upgrade-openssh-server-debuginfocentos-upgrade-openssh-server-sysvinitcentos-upgrade-pam_ssh_agent_authcentos-upgrade-pam_ssh_agent_auth-debuginfo | Nov 24, 2021 | Sep 26, 2021 |
| Debian | debian-upgrade-openssh | Jan 3, 2024 | Sep 26, 2021 | |
| Freebsd | freebsd-upgrade-package-openssh-portablefreebsd-upgrade-package-openssh-portable-hpnfreebsd-upgrade-package-openssh-portable-gssapi | Nov 4, 2022 | Oct 12, 2021 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-opensshhuawei-euleros-2_0_sp10-upgrade-openssh-clientshuawei-euleros-2_0_sp10-upgrade-openssh-server | Feb 28, 2022 | Sep 26, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-opensshhuawei-euleros-2_0_sp5-upgrade-openssh-askpasshuawei-euleros-2_0_sp5-upgrade-openssh-clientshuawei-euleros-2_0_sp5-upgrade-openssh-keycathuawei-euleros-2_0_sp5-upgrade-openssh-server | Mar 2, 2022 | Sep 26, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-opensshhuawei-euleros-2_0_sp8-upgrade-openssh-askpasshuawei-euleros-2_0_sp8-upgrade-openssh-cavshuawei-euleros-2_0_sp8-upgrade-openssh-clientshuawei-euleros-2_0_sp8-upgrade-openssh-keycathuawei-euleros-2_0_sp8-upgrade-openssh-ldaphuawei-euleros-2_0_sp8-upgrade-openssh-server | Dec 28, 2021 | Sep 26, 2021 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-opensshhuawei-euleros-2_0_sp9-upgrade-openssh-clientshuawei-euleros-2_0_sp9-upgrade-openssh-server | Jan 4, 2022 | Sep 26, 2021 | |
| Ibm Aix | ibm-aix-openssh_advisory14 | Oct 12, 2022 | Sep 26, 2021 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Sep 19, 2022 | |
| Openbsd Openssh | openbsd-openssh-upgrade-latest | Nov 26, 2021 | Sep 26, 2021 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-network-openssh-7-5-0-1-0-175-3-36-0-27-0oracle-solaris-11-4-upgrade-network-ssh-8-4-0-1-11-4-40-0-1-107-2oracle-solaris-11-4-upgrade-service-network-ssh-8-4-0-1-11-4-40-0-1-107-2 | Dec 13, 2021 | Sep 26, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-opensshoracle-linux-upgrade-openssh-askpassoracle-linux-upgrade-openssh-cavsoracle-linux-upgrade-openssh-clientsoracle-linux-upgrade-openssh-keycatoracle-linux-upgrade-openssh-ldaporacle-linux-upgrade-openssh-serveroracle-linux-upgrade-openssh-server-sysvinitoracle-linux-upgrade-pam-ssh-agent-auth | Nov 24, 2021 | Sep 26, 2021 |
| Redhat_linux | redhat-upgrade-opensshredhat-upgrade-openssh-askpassredhat-upgrade-openssh-askpass-debuginforedhat-upgrade-openssh-cavsredhat-upgrade-openssh-cavs-debuginforedhat-upgrade-openssh-clientsredhat-upgrade-openssh-clients-debuginforedhat-upgrade-openssh-debuginforedhat-upgrade-openssh-debugsourceredhat-upgrade-openssh-keycatredhat-upgrade-openssh-keycat-debuginforedhat-upgrade-openssh-ldapredhat-upgrade-openssh-ldap-debuginforedhat-upgrade-openssh-serverredhat-upgrade-openssh-server-debuginforedhat-upgrade-openssh-server-sysvinitredhat-upgrade-pam_ssh_agent_authredhat-upgrade-pam_ssh_agent_auth-debuginfo | Nov 24, 2021 | Sep 26, 2021 | |
| Rocky_linux | rocky-upgrade-opensshrocky-upgrade-openssh-askpassrocky-upgrade-openssh-askpass-debuginforocky-upgrade-openssh-cavsrocky-upgrade-openssh-cavs-debuginforocky-upgrade-openssh-clientsrocky-upgrade-openssh-clients-debuginforocky-upgrade-openssh-debuginforocky-upgrade-openssh-debugsourcerocky-upgrade-openssh-keycatrocky-upgrade-openssh-keycat-debuginforocky-upgrade-openssh-ldaprocky-upgrade-openssh-ldap-debuginforocky-upgrade-openssh-serverrocky-upgrade-openssh-server-debuginforocky-upgrade-pam_ssh_agent_authrocky-upgrade-pam_ssh_agent_auth-debuginfo | May 20, 2022 | Sep 26, 2021 | |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-cavssuse-upgrade-openssh-clientssuse-upgrade-openssh-commonsuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-openssl1suse-upgrade-openssh-openssl1-helperssuse-upgrade-openssh-server | Dec 2, 2021 | Sep 26, 2021 |
| Ubuntu | ubuntu-pro-upgrade-openssh-serverubuntu-upgrade-openssh-clientubuntu-upgrade-openssh-server | Oct 11, 2022 | Sep 26, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 26, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub