CVE-2021-27098
Description
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.
How to fix
- cncf spire0.9.4, 0.10.2, 0.11.3, 0.12.1 or later
- github.com/spiffe/spire0.8.5, 0.9.4, 0.10.2, 0.11.3, 0.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cncf spire | 0.8.1 ≤ v ≤ 0.8.4, 0.9.0 ≤ v < 0.9.4, 0.10.0 ≤ v < 0.10.2, 0.11.0 ≤ v < 0.11.3, 0.12.0 ≤ v < 0.12.1 | 0.9.4, 0.10.2, 0.11.3, 0.12.1 |
| github.com/spiffe/spireGo | 0.8.1 ≤ v < 0.8.5, 0.9.0 ≤ v < 0.9.4, 0.10.0 ≤ v < 0.10.2, 0.11.0 ≤ v < 0.11.3, 0.12.0 ≤ v < 0.12.1 | 0.8.5, 0.9.4, 0.10.2, 0.11.3, 0.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.