Comments on CVE-2021-26928?
Hello, with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream. Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928. Thank you. Regards, Robert
On 09/03/2023 13:41, Robert Scheck wrote:
Hello,
with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream.
Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928.
I have a PDF of the Bird help documentation that I saved in 2019 (Fossies) that lists password authentication mechanisms as per RFC2385 with extra options for BSD systems. I'll defer to the Dev team on this for the final word, but someone has some crossed wires here.
Thank you.
Regards, Robert
Regards, William
On 09. 03. 23 5:14, William wrote:
On 09/03/2023 13:41, Robert Scheck wrote:
Hello,
Hi!
with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream.
Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928.
I have a PDF of the Bird help documentation that I saved in 2019 (Fossies) that lists password authentication mechanisms as per RFC2385 with extra options for BSD systems. I'll defer to the Dev team on this for the final word, but someone has some crossed wires here.
Yes, this functionality was added in 1.0.12 (12 Nov 2008). So I do not understand this CVE. Ondrej
Thank you.
Regards, Robert
Regards, William
Hi, I allow myself to jump on this discussion. That CVE report is about attacking a kubernetes cluster running Calico (see the link in the `References to Advisories, Solutions, and Tools` section in the NIST CVE). By default, calico doesn't require password authentication for BGP connections. However, that can be enabled using the `nodeMeshPassword` on the `BGPConfiguration` resource. It can also be enabled on peers outside the cluster using the `password` field of the `BGPPeer` custom resource. I'm not sure if it's possible to enable it globally for the listening socket though. Moreover, Calico uses a self-patched, old, version of Bird. I believe 1.6.8. I "think" that CVE was miss-labeled and shouldn't refer to bird as the source of the problem. I personally use Password authentication with bird without issues. Regard, Radu On 3/9/23 08:15, Ondrej Filip wrote:
On 09. 03. 23 5:14, William wrote:
On 09/03/2023 13:41, Robert Scheck wrote:
Hello,
Hi!
with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream.
Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928.
I have a PDF of the Bird help documentation that I saved in 2019 (Fossies) that lists password authentication mechanisms as per RFC2385 with extra options for BSD systems. I'll defer to the Dev team on this for the final word, but someone has some crossed wires here.
Yes, this functionality was added in 1.0.12 (12 Nov 2008). So I do not understand this CVE.
Ondrej
Thank you.
Regards, Robert
Regards, William
Hello! In fact, I think that Tigera should have never submitted this CVE as it makes not sense at all. Adding the fact that nobody from Tigera has ever reached to us regarding this CVE, this simply isn't a legit CVE. I'll submit a request to reject this CVE. Thank you for pointing to it. Maria On 3/9/23 09:02, Radu CARPA wrote:
Hi,
I allow myself to jump on this discussion. That CVE report is about attacking a kubernetes cluster running Calico (see the link in the `References to Advisories, Solutions, and Tools` section in the NIST CVE). By default, calico doesn't require password authentication for BGP connections. However, that can be enabled using the `nodeMeshPassword` on the `BGPConfiguration` resource. It can also be enabled on peers outside the cluster using the `password` field of the `BGPPeer` custom resource. I'm not sure if it's possible to enable it globally for the listening socket though. Moreover, Calico uses a self-patched, old, version of Bird. I believe 1.6.8.
I "think" that CVE was miss-labeled and shouldn't refer to bird as the source of the problem. I personally use Password authentication with bird without issues.
Regard, Radu
On 3/9/23 08:15, Ondrej Filip wrote:
On 09. 03. 23 5:14, William wrote:
On 09/03/2023 13:41, Robert Scheck wrote:
Hello,
Hi!
with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream.
Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928.
I have a PDF of the Bird help documentation that I saved in 2019 (Fossies) that lists password authentication mechanisms as per RFC2385 with extra options for BSD systems. I'll defer to the Dev team on this for the final word, but someone has some crossed wires here.
Yes, this functionality was added in 1.0.12 (12 Nov 2008). So I do not understand this CVE.
Ondrej
Thank you.
Regards, Robert
Regards, William
Errata: s/Tigera/CyberArk Labs/g I misread the sources. Thanks to Santiago for correcting me. Maria On 3/10/23 00:09, Maria Matejka via Bird-users wrote:
Hello!
In fact, I think that Tigera should have never submitted this CVE as it makes not sense at all. Adding the fact that nobody from Tigera has ever reached to us regarding this CVE, this simply isn't a legit CVE.
I'll submit a request to reject this CVE. Thank you for pointing to it.
Maria
On 3/9/23 09:02, Radu CARPA wrote:
Hi,
I allow myself to jump on this discussion. That CVE report is about attacking a kubernetes cluster running Calico (see the link in the `References to Advisories, Solutions, and Tools` section in the NIST CVE). By default, calico doesn't require password authentication for BGP connections. However, that can be enabled using the `nodeMeshPassword` on the `BGPConfiguration` resource. It can also be enabled on peers outside the cluster using the `password` field of the `BGPPeer` custom resource. I'm not sure if it's possible to enable it globally for the listening socket though. Moreover, Calico uses a self-patched, old, version of Bird. I believe 1.6.8.
I "think" that CVE was miss-labeled and shouldn't refer to bird as the source of the problem. I personally use Password authentication with bird without issues.
Regard, Radu
On 3/9/23 08:15, Ondrej Filip wrote:
On 09. 03. 23 5:14, William wrote:
On 09/03/2023 13:41, Robert Scheck wrote:
Hello,
Hi!
with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream.
Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928.
I have a PDF of the Bird help documentation that I saved in 2019 (Fossies) that lists password authentication mechanisms as per RFC2385 with extra options for BSD systems. I'll defer to the Dev team on this for the final word, but someone has some crossed wires here.
Yes, this functionality was added in 1.0.12 (12 Nov 2008). So I do not understand this CVE.
Ondrej
Thank you.
Regards, Robert
Regards, William
On Thu, 9 Mar 2023, Ondrej Filip wrote:
On 09. 03. 23 5:14, William wrote:
On 09/03/2023 13:41, Robert Scheck wrote:
Hello,
Hi!
with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream.
Do you see any chance for some comments on it (at least here)? Not sure if MITRE adds it then as references at CVE-2021-26928.
I have a PDF of the Bird help documentation that I saved in 2019 (Fossies) that lists password authentication mechanisms as per RFC2385 with extra options for BSD systems. I'll defer to the Dev team on this for the final word, but someone has some crossed wires here.
Yes, this functionality was added in 1.0.12 (12 Nov 2008). So I do not understand this CVE.
Explanation is probably here: https://www.cyberark.com/resources/threat-research-blog/attacking-kubernetes... at the end in the Disclosure Timeline.
Ondrej
Adam Pribyl
participants (6)
-
Adam Pribyl -
Maria Matejka -
Ondrej Filip -
Radu CARPA -
Robert Scheck -
William