What is CVE-2021-3684?

CVE-2021-3684 is a medium-severity vulnerability in Red Hat Enterprise Linux, classified under Insertion of Sensitive Information into Log File. CVSS score: 5.5/10. Published 2023-03-24.

How severe is CVE-2021-3684?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Information disclosure in Red Hat Enterprise Linux

CVE-2021-3684

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.

EPSS: 0.002 (16.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Redhat Enterprise_linux — versions 8.0
Redhat Openshift_assisted_installer
Redhat Openshift_container_platform — versions 4.6
N/a Assisted-installer — versions openshift/assisted-installer 1.0.25.1, openshift/assisted-installer 2.0.0

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

secalert@redhat.com (Patch, Issue Tracking, Vendor Advisory)
secalert@redhat.com (Patch)
secalert@redhat.com (Patch)

Frequently asked questions

What is CVE-2021-3684?: CVE-2021-3684 is a medium-severity vulnerability in Red Hat Enterprise Linux, classified under Insertion of Sensitive Information into Log File. CVSS score: 5.5/10. Published 2023-03-24.
How severe is CVE-2021-3684?: Medium severity. CVSS v3 base score is 5.5 out of 10.