CVE-2021-28041
High
Description
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
SeverityHigh
CVSS7.1
Exploit probability—
Product
Openbsd Openssh
PublishedMar 5, 2021
First seenMar 5, 2021
How to fix
Update
- openbsd openssh8.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbsd openssh | 8.2 ≤ v < 8.5 | 8.5 |
| fedoraproject fedora | 33, 34 | — |
| netapp cloud_backup | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp hci_compute_node_firmware | No range specified | — |
| netapp hci_storage_node_firmware | No range specified | — |
| oracle communications_offline_mediation_controller | 12.0.0.3.0 | — |
| oracle zfs_storage_appliance | 8.8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.