Threats tagged 'ghsa-339v-266x-79xr'

Nebula-mesh contains two related authorization flaws that allow hosts that have been blocked or offboarded to obtain new valid certificates. The system does not enforce the blocklist or host status checks at certificate issuance or re-enrollment time, allowing blocked hosts to regain trust by re-enrolling. Additionally, certificate renewal does not verify whether the owning operator or CA is still active, enabling hosts from disabled operators to continue renewing certificates indefinitely. These issues affect versions prior to 0.3.7 and have been fixed in version 0.3.7.