CVE-2021-27098

Vulnerability in github.com/spiffe/spire (CVE-2021-27098)

Summary

Vulnerability in github.com/spiffe/spire (CVE-2021-27098). Confidential information can be exposed externally. Mitigation: upgrade to 0.12.1 or later.

Original description

The description as published by the source.

Summary

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API (github.com/spiffe/spire/pkg/server/endpoints/node) can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.

What are the changes introduced by the patched versions?

The changes introduced to address this issue are related to enforcing that the FetchX509SVID RPC of SPIRE Server’s Legacy Node API only issues X.509 certificates with SPIFFE IDs that the agent is authorized to distribute.

The patched version also includes a back-ported change that improves the handling of file descriptors related to workload attestation in SPIRE Agent.

There are no changes in the expected behavior of SPIRE.

Should I upgrade SPIRE?

All SPIRE users running affected versions are advised to upgrade to the corresponding patched version.

Workarounds

No workarounds have been identified for this vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2021-27098 has been found in github.com/spiffe/spire.
Confidential information can be exposed externally.
What to do: upgrade github.com/spiffe/spire to 0.12.1 or later.
If unsure, ask your IT team or search "github.com/spiffe/spire CVE-2021-27098" on the vendor's site.

CVE-2021-27098 (github.com/spiffe/spire) — CWE-284
Attack vector: remote (network-reachable) / no user interaction
Patched: 0.12.1 — apply immediately
Workaround: No workarounds have been identified for this vulnerability.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-284) exists in github.com/spiffe/spire.

📍 Affected scope

Check the vendor advisory for the affected versions of github.com/spiffe/spire.

🔥 Severity

Severity: ?. Confidential information can be exposed externally.

🔧 How to fix

Update to 0.12.1.

🛡️ Workaround

Workaround: No workarounds have been identified for this vulnerability.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/spiffe/spire' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'github.com/spiffe/spire' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/spiffe/spire を grep し、稼働しているサービス・バージョンを把握する。
2
Apply temporary workaround mitigate
```
No workarounds have been identified for this vulnerability.
```
パッチが適用されるまでの応急処置として、No workarounds have been identified for this vulnerability. を実施。回避策の副作用 (機能低下) を確認した上で。
3
Apply patch patch
```
Upgrade github.com/spiffe/spire to 0.12.1
```
ステージング環境で 0.12.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
4
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Go github.com/spiffe/spire

[{"type":"SEMVER","events":[{"introduced":"0.12.0"},{"fixed":"0.12.1"}]}]

References

Metadata

CVE: CVE-2021-27098
GHSA: GHSA-h746-rm5q-8mgq
Published: 2021-05-21
First seen on SecPulse: 5 years ago
First-seen source: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-284 CWE-295

Detection sources

OSV.dev (Open Source Vulnerabilities) 3 months ago