PT-2021-23990 · Styra · Styra Open Policy Agent (Opa) Gatekeeper

Published 2021-11-17 · Updated 2024-08-04 · CVE-2021-43979

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Styra Open Policy Agent (OPA) Gatekeeper versions 3.7.0 and earlier

Description: The issue arises from the mishandling of concurrency, which can result in incorrect access control. This occurs because the data replication mechanism, allowing policies to access the Kubernetes cluster state, does not wait for replication to finish before processing a request. This can cause inconsistencies between the replicated resources in OPA/Gatekeeper and the resources actually present in the cluster, potentially leading to a policy bypass. It's noted that the vendor disagrees with this being classified as a vulnerability, citing that Kubernetes states are only eventually consistent.

Recommendations: For versions 3.7.0 and earlier, consider implementing a mechanism to ensure that the data replication finishes before processing requests to minimize the risk of inconsistencies and potential policy bypasses. As a temporary workaround, consider restricting access to sensitive resources until a more robust solution can be implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2021-43979

Affected Products

Styra Open Policy Agent (Opa) Gatekeeper

References · 5

• https://github.com/open-policy-agent/gatekeeper/releases · Patch
• https://osv.dev/vulnerability/CVE-2021-43979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43979 · Security Note
• https://github.com/hkerma/opa-gatekeeper-concurrency-issue · Note
• https://t.me/cvenotify/88918 · Telegram Post