Re: Comments on CVE-2021-26928?

2023-03-09 Thread Maria Matejka via Bird-users
Errata: s/Tigera/CyberArk Labs/g I misread the sources. Thanks to Santiago for correcting me. Maria On 3/10/23 00:09, Maria Matejka via Bird-users wrote: Hello! In fact, I think that Tigera should have never submitted this CVE as it makes not sense at all. Adding the fact that nobody from

Re: Comments on CVE-2021-26928?

2023-03-09 Thread Maria Matejka via Bird-users
Hello! In fact, I think that Tigera should have never submitted this CVE as it makes not sense at all. Adding the fact that nobody from Tigera has ever reached to us regarding this CVE, this simply isn't a legit CVE. I'll submit a request to reject this CVE. Thank you for pointing to it.

Re: Comments on CVE-2021-26928?

2023-03-09 Thread Adam Pribyl
On Thu, 9 Mar 2023, Ondrej Filip wrote: On 09. 03. 23 5:14, William wrote: On 09/03/2023 13:41, Robert Scheck wrote: Hello, Hi! with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains

Re: Comments on CVE-2021-26928?

2023-03-09 Thread Radu CARPA
Hi, I allow myself to jump on this discussion. That CVE report is about attacking a kubernetes cluster running Calico (see the link in the `References to Advisories, Solutions, and Tools` section in the NIST CVE). By default, calico doesn't require password authentication for BGP connections.

Re: Comments on CVE-2021-26928?

2023-03-08 Thread Ondrej Filip
On 09. 03. 23 5:14, William wrote: On 09/03/2023 13:41, Robert Scheck wrote: Hello, Hi! with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link

Re: Comments on CVE-2021-26928?

2023-03-08 Thread William
On 09/03/2023 13:41, Robert Scheck wrote: Hello, with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream. Do you see any

Comments on CVE-2021-26928?

2023-03-08 Thread Robert Scheck
Hello, with https://bugzilla.redhat.com/show_bug.cgi?id=2176483, Red Hat pointed me today to CVE-2021-26928. https://nvd.nist.gov/vuln/detail/CVE-2021-26928 contains a reference to BIRD 2.0.7, but no link related to BIRD upstream. Do you see any chance for some comments on it (at least here)?