Gatekeeper Policy Manager release v2.1.2

Welcome to the release of Gatekeeper Policy Manager v2.1.2, maintained with ❤️ by the team SIGHUP by ReeVo.

This release updates github.com/go-jose/go-jose/v4 to fix a low-impact denial of service. Only GPM with GPM_AUTH_ENABLED=JWT is affected.

Security fixes 🔒

• github.com/go-jose/go-jose/v4 v4.1.6 fixes a denial of service (GHSA-mgcc-cww5-fp2q). In the JWT mode, GPM reads the assertion from a request header, and go-jose parses the token header before GPM verifies the signature. A token can carry a crafted RSA key in its jwk header, and go-jose v4.1.5 validates that key in a time that is cubic in its size. Thus a client that can connect to GPM, without logging in, can keep GPM busy for minutes or hours with one request. The impact is low: only GPM stops answering. The manifests and the Helm chart of GPM set a CPU limit, so the other workloads on the node keep their CPU. Gatekeeper continues to enforce your policies, and no data is exposed. The OIDC mode is not affected, because GPM verifies only the ID token that it gets from the token endpoint of your provider.

Upgrade procedure

GPM now refuses a JWK set that holds an RSA key larger than 4096 bits, and then it rejects every token. This applies to the JWK set of your OIDC provider and to GPM_JWT_JWK_SET_URL. Before you upgrade, make sure that no RSA key in these sets is larger than 4096 bits. For more information, read "Authentication" in the documentation.

If your keys are of 4096 bits or less, this release needs no action. Update the image tag, then apply the manifests or upgrade the Helm release as usual.