CVE-2021-28041
גבוהה 7.1
תיאור (מקור, אנגלית)
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
מדדים
- CVSS 3.1
-
7.1 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 3% (אחוזון 100) נכון ל-14/10/2026
- CWE
- CWE-415
מוצרים מושפעים
openbsd: openssh; fedoraproject: fedora; netapp: cloud backup; netapp: hci management node; netapp: solidfire; netapp: hci compute node firmware; netapp: hci compute node; netapp: hci storage node firmware; netapp: hci storage node; oracle: communications offline mediation controller; oracle: zfs storage appliance
קישורים
- https://www.openssh.com/security.html Not ApplicableVendor Advisory
- https://www.openssh.com/txt/release-8.5 Release NotesVendor Advisory
- https://www.openssh.com/security.html Not ApplicableVendor Advisory
- https://www.openssh.com/txt/release-8.5 Release NotesVendor Advisory
- https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d994639… PatchThird Party Advisory
- https://www.openwall.com/lists/oss-security/2021/03/03/1 Mailing ListPatchThird Party Advisory
- https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d994639… PatchThird Party Advisory
- https://www.openwall.com/lists/oss-security/2021/03/03/1 Mailing ListPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap…