CVE-2021-41617 Security vulnerability for RSA Authentication Manager 8.6.x
2 years ago
Article Number
000068011
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.6.x
Vulnerability : CVE-2021-41617: OpenSSH security vulnerability
 
CVE Identifier(s)
CVE-2021-41617
Link to Advisories
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41617
https://www.suse.com/security/cve/CVE-2021-41617.html
Alert Impact
Impacted - Apply RSA Remedy
Resolution
The patch for this CVE is in AM 8.7 P1 (it appears in AM 8.7 as well).

Upgrade to 8.7 P1 

Addressed in SLES 12 SP5 for package openssh >= 7.2p2-78.13.1.
RSA Authentication Manager 8.7 P1 uses version 7.2p2-78.13.1 and so includes the fix for CVE-2021-41617.

Reference: https://www.suse.com/security/cve/CVE-2021-41617.html


 
Notes

Even without the fix, there is no impact from this issue since RSA Authentication Manager does not configure SSH in the manner required for the vulnerability to exist.

Also, remember that the SSH interface is not enabled by default and RSA recommends that customers DO NOT enable this interface unless required for maintenance and then disable it when maintenance is complete.

Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, Dell EMC, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Related Articles

Trending Articles

Don't see what you're looking for?