CVE-2021-20319
First published: Thu Oct 07 2021(Updated: )
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/coreos-installer | <0.10.1 | 0.10.1 |
| Redhat Coreos-installer | <0.10.1 |
Remedy
https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2011862
- https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89
- https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2013108
- https://access.redhat.com/errata/RHSA-2021:3934
- https://access.redhat.com/security/cve/cve-2021-20319
- https://access.redhat.com/errata/RHSA-2021:3926
- https://access.redhat.com/errata/RHSA-2021:3930
- https://access.redhat.com/errata/RHSA-2021:4008
Frequently Asked Questions
What is the severity of CVE-2021-20319?
CVE-2021-20319 has been categorized with a high severity due to the potential for an attacker to bypass signature verification and install unsigned content.
How do I fix CVE-2021-20319?
To fix CVE-2021-20319, upgrade the coreos-installer package to version 0.10.1 or higher.
What type of vulnerability is CVE-2021-20319?
CVE-2021-20319 is an improper signature verification vulnerability that affects the coreos-installer.
What can an attacker do with CVE-2021-20319?
An attacker can modify the installation image to bypass signature verification, potentially leading to the installation of malicious or unsigned content.
Which software is affected by CVE-2021-20319?
CVE-2021-20319 affects the coreos-installer package from Red Hat up to version 0.10.1.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-20319
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/source
- vendor/redhat
- canonical/redhat coreos-installer
- package-manager/redhat