Uber · Report #1177356
pam_ussh does not properly validate the SSH certificate authority
Validstatus
mediumseverity
31upvotes
21 Jul 2021disclosed
Summary
The pam_ussh module that Uber open-sourced in https://github.com/uber/pam-ussh does not validate that the SSH certificate presented by a user is actually signed by a trusted CA listed in the configured ca_file.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.