A security-focused maintenance release fixes two vulnerabilities in node attestation and join token handling. Operators should use this release to receive these fixes.
Check if affected (2)
securityThe
aws_iidattestation identity verificationApplies if you use the
aws_iidserver node attestor plugin.The
aws_iidserver node attestor plugin no longer returns an identity document from an attacker-controlled field after verifying theRSA-2048 PKCS7signature. The fix prevents a compromised EC2 instance from impersonating another instance during node attestation.securityJoin token data store deletion
Applicability is not stated in the release notes.
The join token data store now uses a read-modify-write transaction with row locking and verifies that exactly one row was deleted. This fixes a TOCTOU issue where concurrent attestations using the same token could both succeed because
tx.did not report when no row was deleted.Delete()