CVE-2021-41617

Name	CVE-2021-41617
Description	sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	995130

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openssh (PTS)	buster	1:7.9p1-10+deb10u2	vulnerable
	buster (security)	1:7.9p1-10+deb10u1	vulnerable
	bullseye	1:8.4p1-5+deb11u1	vulnerable
	bookworm, sid	1:9.2p1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
openssh	source	(unstable)	1:8.7p1-1			995130

Notes

[bullseye] - openssh <no-dsa> (Minor issue)
[buster] - openssh <no-dsa> (Minor issue)
[stretch] - openssh <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2021/09/26/1
https://github.com/openssh/openssh-portable/commit/f3cbe43e28fe71427d41cfe3a17125b972710455
https://github.com/openssh/openssh-portable/commit/bf944e3794eff5413f2df1ef37cddf96918c6bde