Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/spiffe/spire < 1.0.3; >= 1.1.0, < 1.1.3
Fixed in
1.1.31.0.3· Vendor fix available
Issue
Impact The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/http package. HTTP/2 endpoints consuming the net/http package within SPIRE server and agent (or other components in this repository) that are on by default include the following: - OIDC Discovery Provider - K8s Workload Registrar in webhook mode The following endpoints are vulnerable when enabled: - SPIRE server bundle endpoint (i.e. Federation API) The following endpoints are NOT vulnerable, since HTTP/2 support in go is not enabled on non-TLS protected endpoints: - SPIRE server/agent metrics endpoint when configured for Prometheus - SPIRE server/agent health endpoints - SPIRE server/agent profiling endpoints Patches SPIRE 1.0.3 and 1.1.3 have been released with an upgraded Go toolchain which…
Recommended action: Upgrade to 1.1.3 or 1.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
0.8.50.12.10.9.40.11.30.10.2· Vendor fix available
Issue
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API (github.com/spiffe/spire/pkg/server/endpoints/node) can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1. What are the changes introduced by the patched versions? The changes introduced to address this issue are related to enforcing that the FetchX509SVID RPC of SPIRE Server’s Legacy Node API only issues X.509 certificates with SPIFFE IDs that the agent is authorized to distribute.…
Recommended action: Upgrade to 0.12.1, 0.11.3, 0.10.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.