This release fixes an agent version-reporting defect during re-attestation or SVID renewal. The recorded release note describes the agent's startup version being replaced by an empty string during that process.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release adds agent version reporting, changes TLS policy behavior, improves performance, and corrects several defects. It also includes security fixes for selector logging and TLS certificate chain validation.
Action needed (1)
securityAgent-level selector logging removal
Selectors are no longer logged at the agent level to avoid potential leakage of sensitive information.
Check if affected (1)
securityServer TCP endpoint TLS session tickets disabled
Applies if you use the server TCP endpoint.
TLS session tickets are disabled on the server side, so
VerifyPeerCertificateruns on every connection and TLS session ticket resumption cannot bypass SPIFFE certificate chain validation against the current trust bundle.
Fixes two security vulnerabilities in server node attestor plugins: an SSRF issue and excessive CPU consumption during node attestation. The fixes apply to the http_challenge and x509pop plugins.
Check if affected (2)
securityThe
http_challengeserver node attestor plugin, SSRF issue fixedApplies if you use
http_challenge.The
http_challengeserver node attestor plugin no longer permits an attacker to redirectspire-serverto an unauthorized domain, make an unauthenticated GET request, and receive the first 64 bytes of the response.securityThe
x509popserver node attestor plugin, CPU-exhaustion issue fixedApplies if you use
x509pop.The
x509popserver node attestor plugin no longer allows an attacker to makespire-serverconsume disproportionate CPU time during node attestation.
A security maintenance release with fixes in server node attestor plugins. The corrected issues affect request handling and resource use during node attestation.
Check if affected (2)
securityThe
http_challengeserver node attestor plugin, SSRF issue correctedApplies if you use the
http_challengeserver node attestor plugin.The fix addresses an SSRF issue that could redirect
spire-serverto an inaccessible domain, make an unauthenticated GET request, and return the first 64 bytes of the response to the attacker.securityThe
x509popserver node attestor plugin, CPU consumption issue correctedApplies if you use the
x509popserver node attestor plugin.The fix addresses an issue that could cause
spire-serverto consume large and disproportionate amounts of CPU time during node attestation.