Access Restriction Bypass Affecting github.com/spiffe/spire/pkg/server/endpoints/node Open this link in a new tab package, versions >=0.8.1 <0.8.5 >=0.9.0 <0.9.4 >=0.10.0 <0.10.2 >=0.11.0 <0.11.3 >=0.12.0 <0.12.1
Attack Complexity
Low
Confidentiality
High
Integrity
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-GOLANG-GITHUBCOMSPIFFESPIREPKGSERVERENDPOINTSNODE-1083205
-
published
7 Mar 2021
-
disclosed
7 Mar 2021
-
credit
c53robin
Introduced: 7 Mar 2021
CVE-2021-27098 Open this link in a new tabHow to fix?
Upgrade github.com/spiffe/spire/pkg/server/endpoints/node
to version 0.8.5, 0.9.4, 0.10.2, 0.11.3, 0.12.1 or higher.
Overview
Affected versions of this package are vulnerable to Access Restriction Bypass. Specially crafted requests to the FetchX509SVID RPC
of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN
for a SPIFFE ID
that the agent is not authorized to distribute.