EUVD-2021-1097

Malware in sbrugna...

Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node

Summary In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API github.com/spiffe/spire/pkg/server/endpoints/node can result in the possible issuance of an X.509 certificate with a URI...

GHSA-H746-RM5Q-8MGQ Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node

Summary In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API github.com/spiffe/spire/pkg/server/endpoints/node can result in the possible issuance of an X.509 certificate with a URI...

CVE-2021-27098

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

CVE-2021-27098

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

CVE-2021-27098

SPIRE contains an authorization bypass vulnerability in the Legacy Node API FetchX509SVID path. Specifically, before versions 0.8.5, and prior to 0.9.4, 0.10.2, 0.11.3, and 0.12.1, specially crafted requests could cause the server to issue an X.509 certificate with a URI SAN for a SPIFFE ID that ...

CVE-2021-27098: Improper Certificate Validation

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

PT-2021-17247

Name of the Vulnerable Software and Affected Versions: SPIRE versions 0.8.1 through 0.8.4 SPIRE versions prior to 0.9.4 SPIRE versions prior to 0.10.2 SPIRE versions prior to 0.11.3 SPIRE versions prior to 0.12.1 Description: Specially crafted requests to the "FetchX509SVID RPC" of SPIRE Server’s...