PT-2021-7253 · Openssh · Openssh

Published 2021-04-19 · Updated 2021-04-19

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH (affected versions not specified)

Description The issue is related to the OpenSSH cryptographic protection tool, where the application fails to properly impose security restrictions when the LogVerbose keyword parameter is enabled with a set of parameters that activate logging for the isolated sshd process with low privileges. This could allow a remote attacker, who can exploit the low-privilege process, to bypass OpenSSH's forwarding and attack high-privilege processes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2022-04245

Affected Products

Openssh

References · 2

• https://bdu.fstec.ru/vul/2022-04245 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory