Security update for openssh SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0805-1 Final 1 1 2022-03-10T17:05:58Z current 2022-03-10T17:05:58Z 2022-03-10T17:05:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssh This update for openssh fixes the following issues: - CVE-2021-41617: Fixed a potential privilege escalation for non-default configuration settings (bsc#1190975). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container ses/7/cephcsi/cephcsi:latest-2022-805,Container ses/7/rook/ceph:latest-2022-805,Image SLES15-SP2-BYOS-Azure-2022-805,Image SLES15-SP2-BYOS-EC2-HVM-2022-805,Image SLES15-SP2-BYOS-GCE-2022-805,Image SLES15-SP2-CHOST-BYOS-Aliyun-2022-805,Image SLES15-SP2-CHOST-BYOS-Azure-2022-805,Image SLES15-SP2-CHOST-BYOS-EC2-2022-805,Image SLES15-SP2-CHOST-BYOS-GCE-2022-805,Image SLES15-SP2-HPC-BYOS-Azure-2022-805,Image SLES15-SP2-HPC-BYOS-EC2-HVM-2022-805,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure-2022-805,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM-2022-805,Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE-2022-805,Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2022-805,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2022-805,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2022-805,Image SLES15-SP2-SAP-Azure-2022-805,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2022-805,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2022-805,Image SLES15-SP2-SAP-BYOS-Azure-2022-805,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2022-805,Image SLES15-SP2-SAP-BYOS-GCE-2022-805,Image SLES15-SP2-SAP-EC2-HVM-2022-805,Image SLES15-SP2-SAP-GCE-2022-805,SUSE-2022-805,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-805,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-805,SUSE-SLE-Product-RT-15-SP2-2022-805,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-805,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-805,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-805,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-805,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-805,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-805,SUSE-SUSE-MicroOS-5.0-2022-805,SUSE-Storage-7-2022-805 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220805-1/ Link for SUSE-SU-2022:0805-1 https://lists.suse.com/pipermail/sle-security-updates/2022-March/010415.html E-Mail link for SUSE-SU-2022:0805-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190975 SUSE Bug 1190975 https://www.suse.com/security/cve/CVE-2021-41617/ SUSE CVE CVE-2021-41617 page Container ses/7/cephcsi/cephcsi:latest Container ses/7/rook/ceph:latest Image SLES15-SP2-BYOS-Azure Image SLES15-SP2-BYOS-EC2-HVM Image SLES15-SP2-BYOS-GCE Image SLES15-SP2-CHOST-BYOS-Aliyun Image SLES15-SP2-CHOST-BYOS-Azure Image SLES15-SP2-CHOST-BYOS-EC2 Image SLES15-SP2-CHOST-BYOS-GCE Image SLES15-SP2-HPC-BYOS-Azure Image SLES15-SP2-HPC-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Server 15 SP2-BCL SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openssh-8.1p1-5.21.1 openssh-fips-8.1p1-5.21.1 openssh-askpass-gnome-8.1p1-5.21.1 openssh-cavs-8.1p1-5.21.1 openssh-helpers-8.1p1-5.21.1 openssh-8.1p1-5.21.1 as a component of Container ses/7/cephcsi/cephcsi:latest openssh-fips-8.1p1-5.21.1 as a component of Container ses/7/cephcsi/cephcsi:latest openssh-8.1p1-5.21.1 as a component of Container ses/7/rook/ceph:latest openssh-fips-8.1p1-5.21.1 as a component of Container ses/7/rook/ceph:latest openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-BYOS-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-BYOS-EC2-HVM openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-BYOS-GCE openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-CHOST-BYOS-Aliyun openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-CHOST-BYOS-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-CHOST-BYOS-EC2 openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-CHOST-BYOS-GCE openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-HPC-BYOS-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-HPC-BYOS-EC2-HVM openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-EC2-HVM openssh-8.1p1-5.21.1 as a component of Image SLES15-SP2-SAP-GCE openssh-8.1p1-5.21.1 as a component of SUSE Enterprise Storage 7 openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Enterprise Storage 7 openssh-fips-8.1p1-5.21.1 as a component of SUSE Enterprise Storage 7 openssh-helpers-8.1p1-5.21.1 as a component of SUSE Enterprise Storage 7 openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS openssh-fips-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS openssh-helpers-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS openssh-fips-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS openssh-helpers-8.1p1-5.21.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Micro 5.0 openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 openssh-fips-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 openssh-helpers-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL openssh-fips-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL openssh-helpers-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS openssh-fips-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS openssh-helpers-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS openssh-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 openssh-fips-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 openssh-helpers-8.1p1-5.21.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 openssh-8.1p1-5.21.1 as a component of SUSE Manager Proxy 4.1 openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Manager Proxy 4.1 openssh-fips-8.1p1-5.21.1 as a component of SUSE Manager Proxy 4.1 openssh-helpers-8.1p1-5.21.1 as a component of SUSE Manager Proxy 4.1 openssh-8.1p1-5.21.1 as a component of SUSE Manager Retail Branch Server 4.1 openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Manager Retail Branch Server 4.1 openssh-fips-8.1p1-5.21.1 as a component of SUSE Manager Retail Branch Server 4.1 openssh-helpers-8.1p1-5.21.1 as a component of SUSE Manager Retail Branch Server 4.1 openssh-8.1p1-5.21.1 as a component of SUSE Manager Server 4.1 openssh-askpass-gnome-8.1p1-5.21.1 as a component of SUSE Manager Server 4.1 openssh-fips-8.1p1-5.21.1 as a component of SUSE Manager Server 4.1 openssh-helpers-8.1p1-5.21.1 as a component of SUSE Manager Server 4.1 sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. CVE-2021-41617 Container ses/7/cephcsi/cephcsi:latest:openssh-8.1p1-5.21.1 Container ses/7/cephcsi/cephcsi:latest:openssh-fips-8.1p1-5.21.1 Container ses/7/rook/ceph:latest:openssh-8.1p1-5.21.1 Container ses/7/rook/ceph:latest:openssh-fips-8.1p1-5.21.1 Image SLES15-SP2-BYOS-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-BYOS-EC2-HVM:openssh-8.1p1-5.21.1 Image SLES15-SP2-BYOS-GCE:openssh-8.1p1-5.21.1 Image SLES15-SP2-CHOST-BYOS-Aliyun:openssh-8.1p1-5.21.1 Image SLES15-SP2-CHOST-BYOS-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-CHOST-BYOS-EC2:openssh-8.1p1-5.21.1 Image SLES15-SP2-CHOST-BYOS-GCE:openssh-8.1p1-5.21.1 Image SLES15-SP2-HPC-BYOS-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-HPC-BYOS-EC2-HVM:openssh-8.1p1-5.21.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM:openssh-8.1p1-5.21.1 Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE:openssh-8.1p1-5.21.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:openssh-8.1p1-5.21.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-BYOS-Azure:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-BYOS-GCE:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-EC2-HVM:openssh-8.1p1-5.21.1 Image SLES15-SP2-SAP-GCE:openssh-8.1p1-5.21.1 SUSE Enterprise Storage 7:openssh-8.1p1-5.21.1 SUSE Enterprise Storage 7:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Enterprise Storage 7:openssh-fips-8.1p1-5.21.1 SUSE Enterprise Storage 7:openssh-helpers-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:openssh-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:openssh-fips-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:openssh-helpers-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:openssh-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:openssh-fips-8.1p1-5.21.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:openssh-helpers-8.1p1-5.21.1 SUSE Linux Enterprise Micro 5.0:openssh-8.1p1-5.21.1 SUSE Linux Enterprise Real Time 15 SP2:openssh-8.1p1-5.21.1 SUSE Linux Enterprise Real Time 15 SP2:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Linux Enterprise Real Time 15 SP2:openssh-fips-8.1p1-5.21.1 SUSE Linux Enterprise Real Time 15 SP2:openssh-helpers-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-BCL:openssh-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-BCL:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-BCL:openssh-fips-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-BCL:openssh-helpers-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-LTSS:openssh-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-LTSS:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-LTSS:openssh-fips-8.1p1-5.21.1 SUSE Linux Enterprise Server 15 SP2-LTSS:openssh-helpers-8.1p1-5.21.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:openssh-8.1p1-5.21.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:openssh-fips-8.1p1-5.21.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:openssh-helpers-8.1p1-5.21.1 SUSE Manager Proxy 4.1:openssh-8.1p1-5.21.1 SUSE Manager Proxy 4.1:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Manager Proxy 4.1:openssh-fips-8.1p1-5.21.1 SUSE Manager Proxy 4.1:openssh-helpers-8.1p1-5.21.1 SUSE Manager Retail Branch Server 4.1:openssh-8.1p1-5.21.1 SUSE Manager Retail Branch Server 4.1:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Manager Retail Branch Server 4.1:openssh-fips-8.1p1-5.21.1 SUSE Manager Retail Branch Server 4.1:openssh-helpers-8.1p1-5.21.1 SUSE Manager Server 4.1:openssh-8.1p1-5.21.1 SUSE Manager Server 4.1:openssh-askpass-gnome-8.1p1-5.21.1 SUSE Manager Server 4.1:openssh-fips-8.1p1-5.21.1 SUSE Manager Server 4.1:openssh-helpers-8.1p1-5.21.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220805-1/ https://www.suse.com/security/cve/CVE-2021-41617.html CVE-2021-41617 https://bugzilla.suse.com/1190975 SUSE Bug 1190975 https://bugzilla.suse.com/1193497 SUSE Bug 1193497 https://bugzilla.suse.com/1196721 SUSE Bug 1196721 https://bugzilla.suse.com/1200782 SUSE Bug 1200782 https://bugzilla.suse.com/1205056 SUSE Bug 1205056 https://bugzilla.suse.com/1212247 SUSE Bug 1212247 https://bugzilla.suse.com/1212281 SUSE Bug 1212281