Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2021-41617 CVE-2023-51384 CVE-2023-51385 |
CWE-ID | CWE-269 CWE-326 CWE-78 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #3 is available. |
Vulnerable software |
Ubuntu Operating systems & Components / Operating system openssh-server (Ubuntu package) Operating systems & Components / Operating system package or component openssh-client (Ubuntu package) Operating systems & Components / Operating system package or component |
Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU58333
Risk: Low
CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-41617
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper privilege management in sshd, when certain non-default configurations are used, because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and
AuthorizedPrincipalsCommand may run with privileges associated with
group memberships of the sshd process, if the configuration specifies
running the command as a different user. A local user can escalate privileges on the system.
Update the affected package openssh to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 23.10
openssh-server (Ubuntu package): before 1:8.2p1-4ubuntu0.11
openssh-client (Ubuntu package): before 1:8.2p1-4ubuntu0.11
CPE2.3https://ubuntu.com/security/notices/USN-6565-1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU84792
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-51384
CWE-ID:
CWE-326 - Inadequate Encryption Strength
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an error in the ssh-agent, which causes certain destination constraints to be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.
MitigationUpdate the affected package openssh to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 23.10
openssh-server (Ubuntu package): before 1:8.2p1-4ubuntu0.11
openssh-client (Ubuntu package): before 1:8.2p1-4ubuntu0.11
CPE2.3https://ubuntu.com/security/notices/USN-6565-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU84789
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2023-51385
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation when processing user names, if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. A remote attacker can execute arbitrary OS commands via an untrusted Git repository.
MitigationUpdate the affected package openssh to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 23.10
openssh-server (Ubuntu package): before 1:8.2p1-4ubuntu0.11
openssh-client (Ubuntu package): before 1:8.2p1-4ubuntu0.11
CPE2.3https://ubuntu.com/security/notices/USN-6565-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.