CVE-2021-20319

Опубликовано: 04 мар. 2022

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=2011862
Issue Tracking
Vendor Advisory
https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89
Patch
Third Party Advisory
https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2011862
Issue Tracking
Vendor Advisory
https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89
Patch
Third Party Advisory
https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redhat:coreos-installer:*:*:*:*:*:*:*:*

Версия до 0.10.1 (исключая)

EPSS

Процентиль: 28%

0.00099

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-347

Связанные уязвимости

CVE-2021-20319

CVSS3: 7.5

redhat

больше 4 лет назад

GHSA-3r3g-g73x-g593