{"api_version":"1","generated_at":"2026-04-22T19:18:05+00:00","cve":"CVE-2021-41617","urls":{"html":"https://cve.report/CVE-2021-41617","api":"https://cve.report/api/cve/CVE-2021-41617.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-41617","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-41617"},"summary":{"title":"CVE-2021-41617","description":"sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-09-26 19:15:00","updated_at":"2023-12-26 04:15:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"https://www.openssh.com/txt/release-8.8","name":"https://www.openssh.com/txt/release-8.8","refsource":"MISC","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"404"},{"url":"https://www.openwall.com/lists/oss-security/2021/09/26/1","name":"https://www.openwall.com/lists/oss-security/2021/09/26/1","refsource":"MISC","tags":[],"title":"oss-security - Announce: OpenSSH 8.8 released","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/","name":"FEDORA-2021-f8df0f8563","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 35 Update: openssh-8.7p1-2.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/","name":"FEDORA-2021-1f7339271d","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 34 Update: openssh-8.6p1-5.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","name":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update Advisory - April 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.tenable.com/plugins/nessus/154174","name":"https://www.tenable.com/plugins/nessus/154174","refsource":"MISC","tags":[],"title":"OpenSSH 6.2 < 8.8 | Tenable®","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.openssh.com/security.html","name":"https://www.openssh.com/security.html","refsource":"MISC","tags":[],"title":"OpenSSH: Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.starwindsoftware.com/security/sw-20220805-0001/","name":"https://www.starwindsoftware.com/security/sw-20220805-0001/","refsource":"MISC","tags":[],"title":"CVE-2021-41617 sshd issue in StarWind products","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/","name":"FEDORA-2021-f8df0f8563","refsource":"","tags":[],"title":"[SECURITY] Fedora 35 Update: openssh-8.7p1-2.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1190975","name":"https://bugzilla.suse.com/show_bug.cgi?id=1190975","refsource":"CONFIRM","tags":[],"title":"Bug 1190975 – VUL-0: CVE-2021-41617: openssh-openssl1,openssh: privilege escalation when AuthorizedKeysCommand/AuthorizedPrincipalsCommand are configured","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.netapp.com/advisory/ntap-20211014-0004/","name":"https://security.netapp.com/advisory/ntap-20211014-0004/","refsource":"CONFIRM","tags":[],"title":"CVE-2021-41617 OpenSSH Vulnerability in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/","name":"FEDORA-2021-fa0e94198f","refsource":"","tags":[],"title":"[SECURITY] Fedora 33 Update: openssh-8.4p1-8.fc33 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","name":"[debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update","refsource":"","tags":[],"title":"[SECURITY] [DLA 3694-1] openssh security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/","name":"FEDORA-2021-1f7339271d","refsource":"","tags":[],"title":"[SECURITY] Fedora 34 Update: openssh-8.6p1-5.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2023/dsa-5586","name":"DSA-5586","refsource":"","tags":[],"title":"Debian -- Security Information -- DSA-5586-1 openssh","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/","name":"FEDORA-2021-fa0e94198f","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 33 Update: openssh-8.4p1-8.fc33 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","name":"N/A","refsource":"N/A","tags":[],"title":"Oracle Critical Patch Update Advisory - July 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41617","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41617","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"33","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"34","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"active_iq_unified_manager","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"vmware_vsphere","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"netapp","cpe5":"aff_500f","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"netapp","cpe5":"aff_500f_firmware","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"netapp","cpe5":"aff_a250","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"netapp","cpe5":"aff_a250_firmware","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"clustered_data_ontap","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"hci_management_node","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"ontap_select_deploy_administration_utility","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"netapp","cpe5":"solidfire","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openbsd","cpe5":"openssh","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"http_server","cpe6":"12.2.1.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"http_server","cpe6":"12.2.1.3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"http_server","cpe6":"12.2.1.4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"zfs_storage_appliance_kit","cpe6":"8.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"41617","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"starwindsoftware","cpe5":"starwind_virtual_san","cpe6":"v8r13","cpe7":"14398","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-41617","qid":"159539","title":"Oracle Enterprise Linux Security Update for openssh (ELSA-2021-4782)"},{"cve":"CVE-2021-41617","qid":"159567","title":"Oracle Enterprise Linux Security Update for openssh (ELSA-2021-9575)"},{"cve":"CVE-2021-41617","qid":"159826","title":"Oracle Enterprise Linux Security Update for openssh (ELSA-2022-2013)"},{"cve":"CVE-2021-41617","qid":"182469","title":"Debian Security Update for openssh (CVE-2021-41617)"},{"cve":"CVE-2021-41617","qid":"200022","title":"Ubuntu Security Notification for OpenSSH Vulnerabilities (USN-6565-1)"},{"cve":"CVE-2021-41617","qid":"239905","title":"Red Hat Update for openssh (RHSA-2021:4782)"},{"cve":"CVE-2021-41617","qid":"240323","title":"Red Hat Update for openssh security (RHSA-2022:2013)"},{"cve":"CVE-2021-41617","qid":"257132","title":"CentOS Security Update for openssh (CESA-2021:4782)"},{"cve":"CVE-2021-41617","qid":"281952","title":"Fedora Security Update for openssh (FEDORA-2021-1f7339271d)"},{"cve":"CVE-2021-41617","qid":"281986","title":"Fedora Security Update for openssh (FEDORA-2021-fa0e94198f)"},{"cve":"CVE-2021-41617","qid":"296066","title":"Oracle Solaris 11.4 Support Repository Update (SRU) 40.107.3 Missing (CPUOCT2021)"},{"cve":"CVE-2021-41617","qid":"296067","title":"Oracle Solaris 11.4 Support Repository Update (SRU) 33.94.0 Missing (CPUAPR2021)"},{"cve":"CVE-2021-41617","qid":"330092","title":"IBM Advanced Interactive eXecutive (AIX) OpenSSH Privilege Excalation Vulnerability (openssh_advisory14)"},{"cve":"CVE-2021-41617","qid":"353162","title":"Amazon Linux Security Advisory for openssh : ALAS2-2022-1748"},{"cve":"CVE-2021-41617","qid":"353169","title":"Amazon Linux Security Advisory for openssh : ALAS-2022-1565"},{"cve":"CVE-2021-41617","qid":"377274","title":"Alibaba Cloud Linux Security Update for openssh (ALINUX2-SA-2021:0066)"},{"cve":"CVE-2021-41617","qid":"38868","title":"OpenSSH Privilege Escalation Vulnerability"},{"cve":"CVE-2021-41617","qid":"500490","title":"Alpine Linux Security Update for openssh"},{"cve":"CVE-2021-41617","qid":"501465","title":"Alpine Linux Security Update for openssh"},{"cve":"CVE-2021-41617","qid":"501761","title":"Alpine Linux Security Update for openssh"},{"cve":"CVE-2021-41617","qid":"501976","title":"Alpine Linux Security Update for openssh"},{"cve":"CVE-2021-41617","qid":"504249","title":"Alpine Linux Security Update for openssh"},{"cve":"CVE-2021-41617","qid":"591311","title":"Bosch Rexroth PRA-ES8P2S Ethernet-Switch Multiple Vulnerabilities (BOSCH-SA-247053-BT)"},{"cve":"CVE-2021-41617","qid":"591406","title":"Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)"},{"cve":"CVE-2021-41617","qid":"6000398","title":"Debian Security Update for openssh (DSA 5586-1)"},{"cve":"CVE-2021-41617","qid":"6000403","title":"Debian Security Update for openssh (DLA 3694-1)"},{"cve":"CVE-2021-41617","qid":"671149","title":"EulerOS Security Update for openssh (EulerOS-SA-2021-2809)"},{"cve":"CVE-2021-41617","qid":"671172","title":"EulerOS Security Update for openssh (EulerOS-SA-2021-2926)"},{"cve":"CVE-2021-41617","qid":"671178","title":"EulerOS Security Update for openssh (EulerOS-SA-2021-2918)"},{"cve":"CVE-2021-41617","qid":"671294","title":"EulerOS Security Update for openssh (EulerOS-SA-2022-1231)"},{"cve":"CVE-2021-41617","qid":"671319","title":"EulerOS Security Update for openssh (EulerOS-SA-2022-1212)"},{"cve":"CVE-2021-41617","qid":"671348","title":"EulerOS Security Update for openssh (EulerOS-SA-2022-1280)"},{"cve":"CVE-2021-41617","qid":"690195","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for openssh (2a1b931f-2b86-11ec-8acd-c80aa9043978)"},{"cve":"CVE-2021-41617","qid":"730409","title":"McAfee Web Gateway Multiple Vulnerabilities (WP-4451,WP-4134,WP-4350,WP-4331,WP-4408,WP-4440,WP-4444,WP-4518,WP-4347,WP-4416)"},{"cve":"CVE-2021-41617","qid":"751435","title":"SUSE Enterprise Linux Security Update for openssh (SUSE-SU-2021:3875-1)"},{"cve":"CVE-2021-41617","qid":"751443","title":"SUSE Enterprise Linux Security Update for openssh (SUSE-SU-2021:3887-1)"},{"cve":"CVE-2021-41617","qid":"751446","title":"SUSE Enterprise Linux Security Update for openssh (SUSE-SU-2021:3951-1)"},{"cve":"CVE-2021-41617","qid":"751452","title":"SUSE Enterprise Linux Security Update for openssh (SUSE-SU-2021:3947-1)"},{"cve":"CVE-2021-41617","qid":"751465","title":"OpenSUSE Security Update for openssh (openSUSE-SU-2021:3950-1)"},{"cve":"CVE-2021-41617","qid":"751856","title":"SUSE Enterprise Linux Security Update for openssh (SUSE-SU-2022:0805-1)"},{"cve":"CVE-2021-41617","qid":"900421","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for openssh (5936)"},{"cve":"CVE-2021-41617","qid":"940541","title":"AlmaLinux Security Update for openssh (ALSA-2022:2013)"},{"cve":"CVE-2021-41617","qid":"960126","title":"Rocky Linux Security Update for openssh (RLSA-2022:2013)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-41617","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.openssh.com/security.html","refsource":"MISC","name":"https://www.openssh.com/security.html"},{"url":"https://www.openwall.com/lists/oss-security/2021/09/26/1","refsource":"MISC","name":"https://www.openwall.com/lists/oss-security/2021/09/26/1"},{"url":"https://www.openssh.com/txt/release-8.8","refsource":"MISC","name":"https://www.openssh.com/txt/release-8.8"},{"refsource":"FEDORA","name":"FEDORA-2021-1f7339271d","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/"},{"refsource":"FEDORA","name":"FEDORA-2021-f8df0f8563","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/"},{"refsource":"FEDORA","name":"FEDORA-2021-fa0e94198f","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpuapr2022.html"},{"refsource":"CONFIRM","name":"https://bugzilla.suse.com/show_bug.cgi?id=1190975","url":"https://bugzilla.suse.com/show_bug.cgi?id=1190975"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20211014-0004/","url":"https://security.netapp.com/advisory/ntap-20211014-0004/"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"refsource":"MISC","name":"https://www.starwindsoftware.com/security/sw-20220805-0001/","url":"https://www.starwindsoftware.com/security/sw-20220805-0001/"},{"refsource":"MISC","name":"https://www.tenable.com/plugins/nessus/154174","url":"https://www.tenable.com/plugins/nessus/154174"}]}},"nvd":{"publishedDate":"2021-09-26 19:15:00","lastModifiedDate":"2023-12-26 04:15:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH"},"exploitabilityScore":1,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:P","accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.4},"severity":"MEDIUM","exploitabilityScore":3.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"8.8","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*","cpe_name":[]}]},{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]},{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8r13:14398:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"41617","Ordinal":"217421","Title":"CVE-2021-41617","CVE":"CVE-2021-41617","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"41617","Ordinal":"1","NoteData":"sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"41617","Ordinal":"2","NoteData":"2021-09-26","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"41617","Ordinal":"3","NoteData":"2021-10-14","Type":"Other","Title":"Modified"}]}}}