Vulnerability Details : CVE-2021-43979
Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish before processing a request, which might cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster. Inconsistency can later be reflected in a policy bypass. NOTE: the vendor disagrees that this is a vulnerability, because Kubernetes states are only eventually consistent
Exploit prediction scoring system (EPSS) score for CVE-2021-43979
Probability of exploitation activity in the next 30 days: 0.08%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 34 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-43979
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2021-43979
-
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-43979
-
https://github.com/hkerma/opa-gatekeeper-concurrency-issue
GitHub - hkerma/opa-gatekeeper-concurrency-issue: PoC of a concurrency issue in OPA/Gatekeeper using data replicationThird Party Advisory
-
https://github.com/open-policy-agent/gatekeeper/releases
Releases · open-policy-agent/gatekeeper · GitHubPatch;Third Party Advisory
Products affected by CVE-2021-43979
- cpe:2.3:a:openpolicyagent:gatekeeper:*:*:*:*:*:*:*:*