Andrey Smirnov 9eaf33f3f2

fix: never sign client certificate requests in trustd ...

Talos worker nodes use `trustd` API on control plane nodes to issue
certificates for `apid` service. Access to the API is protected with the
Talos join token specified in the machine configuration.

There was no validation on what kind of request is requested, so
`trustd` could issue a certificate which is valid for client
authentication with any set of Talos API RBAC roles, including
`os:admin` role allowing full access to the Talos API on control plane
nodes.

See: GHSA-7hgc-php5-77qq
CVE: CVE-2022-36103

Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>

2022-09-13 15:06:09 +04:00

..

internal

fix: never sign client certificate requests in trustd

2022-09-13 15:06:09 +04:00

main.go

chore: limit GOMAXPROCS for Talos services

2022-08-24 15:42:49 +04:00