Releases

Check if affected (1)

• securityAzure IMDS node attestation validation

  Applies if you use the azure_imds server node attestor plugin.

  The azure_imds server node attestor now validates the certificate used for the signature against the trusted Azure roots, preventing forged attested documents from being accepted during node attestation. The fix ships in SPIRE v1.15.1.

Check if affected (1)

• securityThe azure_imds node attestor validation is corrected

  Applies if you use the azure_imds server node attestor plugin.

  SPIRE v1.14.7 corrects validation in the azure_imds server node attestor plugin. The fix ensures the certificate used for signature verification matches the certificate validated against trusted Azure roots, preventing forged attested documents from being accepted.

Check if affected (2)

• securityThe aws_iid attestation identity verification

  Applies if you use the aws_iid server node attestor plugin.

  The aws_iid server node attestor plugin no longer returns an identity document from an attacker-controlled field after verifying the RSA-2048 PKCS7 signature. The fix prevents a compromised EC2 instance from impersonating another instance during node attestation.

• securityJoin token data store deletion

  Applicability is not stated in the release notes.

  The join token data store now uses a read-modify-write transaction with row locking and verifies that exactly one row was deleted. This fixes a TOCTOU issue where concurrent attestations using the same token could both succeed because tx.Delete() did not report when no row was deleted.

Check if affected (1)

• securityCorrected aws_iid EC2 identity verification

  Applies if you use the aws_iid server node attestor plugin.

  The aws_iid server node attestor plugin now verifies the RSA-2048 PKCS7 attestation identity document from the signed content instead of a separate attacker-controlled field. This fix ships in SPIRE v1.13.6.

Action needed (1)

• securityAgent-level selector logging removal

  Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.

Check if affected (2)

• securityThe http_challenge server node attestor plugin, SSRF issue fixed

  Applies if you use http_challenge.

  The http_challenge server node attestor plugin no longer permits an attacker to redirect spire-server to an unauthorized domain, make an unauthenticated GET request, and receive the first 64 bytes of the response.

• securityThe x509pop server node attestor plugin, CPU-exhaustion issue fixed

  Applies if you use x509pop.

  The x509pop server node attestor plugin no longer allows an attacker to make spire-server consume disproportionate CPU time during node attestation.

Check if affected (2)

• securityThe http_challenge server node attestor plugin, SSRF issue corrected

  Applies if you use the http_challenge server node attestor plugin.

  The fix addresses an SSRF issue that could redirect spire-server to an inaccessible domain, make an unauthenticated GET request, and return the first 64 bytes of the response to the attacker.

• securityThe x509pop server node attestor plugin, CPU consumption issue corrected

  Applies if you use the x509pop server node attestor plugin.

  The fix addresses an issue that could cause spire-server to consume large and disproportionate amounts of CPU time during node attestation.