Skip to content
OpenAdvisories

Package · Go

github.com/spiffe/spire

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-m7vp-hqwv-7m5x

    Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints

    ### Impact The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HT…

    github.com/spiffe/spire Go
  • High 8.1
    CVE-2021-27098

    Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node

    In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID…

    github.com/spiffe/spire Go