Vulnerability in Red Hat Coreos-Installer
CVE-2021-20319
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (42.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 42.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Red Hat Coreos-Installer
- Coreos-Installer — versions Affects coreos-installer before v0.10.1, Fixed in v0.10.1.
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Issue Tracking, Vendor Advisory)
- github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593 (Third Party Advisory)
- github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7… (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-20319?
- CVE-2021-20319 is a high-severity vulnerability in Red Hat Coreos-Installer, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.8/10. Published 2022-03-04.
- How severe is CVE-2021-20319?
- High severity. CVSS v3 base score is 7.8 out of 10.