What is CVE-2021-20319?

CVE-2021-20319 is a high-severity vulnerability in Redhat Coreos-Installer, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.8/10. Published 2022-03-04.

How severe is CVE-2021-20319?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Redhat Coreos-Installer

CVE-2021-20319

An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.

EPSS: 0.005 (41.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Redhat Coreos-installer
N/a Coreos-installer — versions Affects coreos-installer before v0.10.1, Fixed in v0.10.1.

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)
secalert@redhat.com (Third Party Advisory, x_refsource_MISC)
secalert@redhat.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-20319?: CVE-2021-20319 is a high-severity vulnerability in Redhat Coreos-Installer, classified under Improper Verification of Cryptographic Signature. CVSS score: 7.8/10. Published 2022-03-04.
How severe is CVE-2021-20319?: High severity. CVSS v3 base score is 7.8 out of 10.