HIGH 7.1 Microsoft
CVE-2021-28041
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios such as unconstrained agent-socket access on a legacy operating system or the forwarding of an agent to an attacker-controlled host.
Microsoft Security Update 2021-Mar: ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios such as unconstrained agent-socket access on a legacy operating system or the forwarding of an agent to an attacker-controlled host.
Affected Products
- openssh-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64
- openssh-clients-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64
- openssh-server-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64
- openssh-debuginfo-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64
- openssh-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARM
- openssh-clients-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARM
- openssh-server-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARM
- openssh-debuginfo-8.5p1-1.cm1.aarch64.rpm on CBL Mariner 1.0 ARM
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28041
- https://nvd.nist.gov/vuln/detail/CVE-2021-28041
This high severity vulnerability with a CVSS score of 7.1 was published on 2021-03-09 via Microsoft. Affected: openssh-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64, openssh-clients-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64, openssh-server-8.5p1-1.cm1.x86_64.rpm on CBL Mariner 1.0 x64 and 5 more.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.