Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact When an authd user logs in via SSH for the first time (meaning they do not yet exist in the authd user database) and successfully authenticates via the configured broker, the user is considered a member of the root group in the context of that SSH session. This situation may allow the user to read and write files that are accessible by the root group, to which they should not have access. The user does not get root privileges or any capabilities beyond the access granted to the root group. Preconditions under which this vulnerability affects a system authd was installed via the PPA. An OAuth 2.0 application was registered in Microsoft Entra ID or Google IAM, and the respective authd broker was installed (authd-msentraid or authd-google) and configured. sshd was configured to enable SSH access with authd, i.e.: The username is allowed by the sshallowedsuffixes option in the broker configuriation. The user is allowed by the allowedusers option in the broker configuration. The…
Recommended action: Upgrade to 0.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/ubuntu/authd < 0.0.0-20240930103526-63e527496b01; >= 0.1.0, < 0.3.5
Fixed in
0.0.0-20240930103526-63e527496b010.3.5· Vendor fix available
Issue
Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. This is possible using tools such as su, sudo or ssh (and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction. Authd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack. su version that will include https://github.com/util-linux/util-linux/pull/3206 will not be affected ssh version that will include https://github.com/openssh/openssh-portable/pull/521 will not be affected sudo version that will include https://github.com/sudo-project/sudo/pull/412 will not be affected login not affected passwd not affected <details <summaryOld report</summary Summary An user can access as another user using its own credentials Details I feel we’ve a security issue…
Recommended action: Upgrade to 0.3.5 or 0.0.0-20240930103526-63e527496b01 (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.