CVE-2021-41617

Name	CVE-2021-41617
Description	sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3694-1
Debian Bugs	995130

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openssh (PTS)	bullseye	1:8.4p1-5+deb11u3	fixed
	bullseye (security)	1:8.4p1-5+deb11u5	fixed
	bookworm	1:9.2p1-2+deb12u6	fixed
	bookworm (security)	1:9.2p1-2+deb12u5	fixed
	sid, trixie	1:10.0p1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
openssh	source	buster	1:7.9p1-10+deb10u4	DLA-3694-1
openssh	source	bullseye	1:8.4p1-5+deb11u3
openssh	source	(unstable)	1:8.7p1-1		995130

Notes

[stretch] - openssh <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2021/09/26/1
https://github.com/openssh/openssh-portable/commit/f3cbe43e28fe71427d41cfe3a17125b972710455
https://github.com/openssh/openssh-portable/commit/bf944e3794eff5413f2df1ef37cddf96918c6bde