Trapperkeeper is the framework we use for running our Clojure based
applications and trapperkeeper-authorization is the shared
authentication library that parses OpenVox’s auth.conf file and
such. This file allows authentication rules to be specified in
multiple ways, including plain strings (foo.example.com), wildcards
(*.example.com), or regular expressions (/lab-\d{3}.example.com/).
Plain strings and wildcard matches were handled by the same logic
and this resulted in wildcard behavior incorrectly showing up in all
non-regex rules. The end result of this meant that a certificate
name of evil.target.example.com would be allowed to impersonate
target.example.com and access information or perform actions as the
target certname. In some non-default configurations, this could even
inject exported resources into arbitrary agent catalogs across the
infrastructure.