Releases

Check if affected (2)

• securityThe aws_iid attestation identity verification

  Applies if you use the aws_iid server node attestor plugin.

  The aws_iid server node attestor plugin no longer returns an identity document from an attacker-controlled field after verifying the RSA-2048 PKCS7 signature. The fix prevents a compromised EC2 instance from impersonating another instance during node attestation.

• securityJoin token data store deletion

  Applicability is not stated in the release notes.

  The join token data store now uses a read-modify-write transaction with row locking and verifies that exactly one row was deleted. This fixes a TOCTOU issue where concurrent attestations using the same token could both succeed because tx.Delete() did not report when no row was deleted.

Check if affected (1)

• securityCorrected aws_iid EC2 identity verification

  Applies if you use the aws_iid server node attestor plugin.

  The aws_iid server node attestor plugin now verifies the RSA-2048 PKCS7 attestation identity document from the signed content instead of a separate attacker-controlled field. This fix ships in SPIRE v1.13.6.