Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-41617: A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privileges, potentially leading to local privilege escalation.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | openssh | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-askpass | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-cavs | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-clients | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-debuginfo | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-keycat | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-ldap | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-server | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | openssh-server-sysvinit | 0:7.4p1-22.amzn2.0.1 |
| Amazon Linux · 2 | pam_ssh_agent_auth | 0:0.10.3-2.22.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —CVE-2021-41617 Public exploit
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalati…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-41617.html