Critical Double Free Vulnerability in OpenSSH Package
Summary
ALPINE-CVE-2021-28041: ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-... Affects openssh versions < 8.3_p1-r2. Fixed in 8.3_p1-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used suite of secure networking utilities based on the SSH protocol, which provides encrypted communication over a computer network. It is essential for secure remote login and other secure network services. The OpenSSH package is integral to many systems, ensuring secure data transmission and authentication. However, it has been identified that versions prior to 8.5 contain a critical vulnerability that could be exploited under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2021-28041, is a double free issue in the ssh-agent component of OpenSSH. This flaw can lead to potential exploitation in scenarios where an attacker has access to the agent socket, particularly on legacy operating systems or when forwarding an agent to a compromised host. The ramifications of this vulnerability include unauthorized access to sensitive data and the potential for remote code execution, making it a significant security concern.
How To Fix
Minimum fixed version
8.3_p1-r2
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to restrict access to the ssh-agent socket and avoid forwarding the agent to untrusted hosts until the package can be updated to a secure version.
Conclusion
The OpenSSH package has a critical vulnerability (CVE-2021-28041) that requires immediate attention. Users should update to the latest patched versions to mitigate risks associated with this vulnerability. Implementing workarounds can provide temporary relief, but updating is the best long-term solution.
See every vulnerability recorded for openssh →
FAQ
CVE-2021-28041 is a vulnerability in OpenSSH that involves a double free in the ssh-agent, which can be exploited under specific conditions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data and potential remote code execution, which can compromise system security.
Use the command 'apk add openssh=<version>' to update to the patched version, replacing <version> with the appropriate fixed version for your Alpine release.
If immediate updating is not possible, restrict access to the ssh-agent socket and avoid forwarding the agent to untrusted hosts as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
