Step CA Improper Authorization Check for SSH Certificate Revocation Vulnerability

A vulnerability exists in Step CA versions prior to 0.29.0, specifically within deployments using the SSHPOP provisioner. The issue arises from an improper authorization check related to SSH certificate revocation, allowing for potential unauthorized actions in this context.

Impact

Exploitation of this vulnerability could lead to improper handling of SSH certificate revocation, potentially allowing unauthorized users to manipulate certificate statuses.

Remediation

Users are advised to upgrade to Step CA version 0.29.0 or later. Instructions for updating can be found in the Step CA repository on GitHub.