CVE-2021-28041: Double Free
Published Mar 5, 2021
·Updated
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
Affected Software
12 affected components
OpenBSD OpenSSH>=8.2<8.5
Fedoraproject Fedora=33
Fedoraproject Fedora=34
NetApp Cloud Backup
NetApp Hci Management Node
NetApp Solidfire
NetApp Hci Compute Node Firmware
NetApp Hci Compute Node
NetApp Hci Storage Node Firmware
NetApp Hci Storage Node
Oracle Communications Offline Mediation Controller=12.0.0.3.0
Oracle ZFS Storage Appliance=8.8
Remediation
Patch Available
Event History
Mar 5, 2021
CVE Published
via MITRE·07:07 PM
Data Sourced
via MITRE·07:07 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-28041?
The severity of CVE-2021-28041 is high with a CVSS score of 7.1.
2
How does CVE-2021-28041 affect OpenSSH?
CVE-2021-28041 affects OpenSSH versions before 8.5.
3
Which operating systems are affected by CVE-2021-28041?
CVE-2021-28041 affects OpenBSD, Fedora 33, and Fedora 34.
4
Are Netapp HCI Compute Node and Netapp HCI Storage Node vulnerable to CVE-2021-28041?
No, Netapp HCI Compute Node and Netapp HCI Storage Node are not vulnerable to CVE-2021-28041.
5
What is the Common Weakness Enumeration (CWE) for CVE-2021-28041?
The CWE for CVE-2021-28041 is CWE-415 (Double Free).