Vulnerability · Published Mar 5, 2021 · Assigned by mitre
CVE-2021-27098
High 8.1
In plain English
A high-severity security flaw in the github.com/spiffe/spire package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/spiffe/spire | 0.8.5 | GHSA-h746-rm5q-8mgq |
| Go | github.com/spiffe/spire | 0.9.4 | GHSA-h746-rm5q-8mgq |
| Go | github.com/spiffe/spire | 0.10.2 | GHSA-h746-rm5q-8mgq |
| Go | github.com/spiffe/spire | 0.11.3 | GHSA-h746-rm5q-8mgq |
| Go | github.com/spiffe/spire | 0.12.1 | GHSA-h746-rm5q-8mgq |