Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints
Date: 2022-01
Affected: go/github.com/spiffe/spire, go/github.com/spiffe/spire
Attack vector: other
Category: vulnerability-disclosure
Severity: High

### Impact The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/http package. HTTP/2 endpoints consuming the net/http package within SPIRE server and agent (or other components in this repository) that are _on by default_ include the following: - OIDC Discovery Provider - K8s Workload Registrar in webhook mode The following endpoints are vulnerable _when enabled_: - SPIRE server bundle endpoint (i.e. Federation API) The following endpoints are _NOT_ vulnerable, since HTTP/2 support in go is not enabled on non-TLS protected endpoints: - SPIRE server/agent metrics endpoint when configured for Prometheus - SPIRE server/agent health endpoints - SPIRE server/agent profiling endpoints ### Patches SPIRE 1.0.3 and 1.1.3 have been released with an upgraded Go toolchain which patches the vulnerability ### Workarounds The vulnerability can be worked around entirely by including the `http2server=0` value in the `GODEBUG` environment variable (see https://github.com/golang/go/issues/50058). This turns off HTTP/2 support on all non-gRPC endpoints. They will still function with HTTP/1.1. The risk associated with this vulnerability can be somewhat mitigated by limiting the exposure of the endpoints in question. If necessary, vulnerable components or endpoin


Mitigations:

Architectural layers (MAESTRO):