CVE-2021-3636: Medium severity redhat Openshift vulnerability
It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.
Other sources
The openshift-service-ca service contains unexpected CAs. In OpenShift 4.8 the service-ca.crt file only contains the self-signed certificate of the openshift-service-serving-signer CA certificate. In older versions of OpenShift there were more, additional CAs: - OU = openshift, CN = kube-apiserver-lb-signer - OU = openshift, CN = kube-apiserver-localhost-signer - OU = openshift, CN = kube-apiserver-service-network-signer - CN = openshift-kube-apiserver-operatorlocalhost-recovery-serving-signer - CN = ingress-operator - CN = .apps.cluster.example.com - CN = openshift-service-serving-signer
This means that an attacker who owns the ingress CA can impersonate as any in-cluster service-ca signed process. The issue impacts Confidentiality and Integrity of the OCP cluster.
OCP 4.8 is not impacted by this vulnerability.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 4.8
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3636?
CVE-2021-3636 has a severity rating that indicates it poses a security risk due to improper certificate generation.
How do I fix CVE-2021-3636?
To remediate CVE-2021-3636, upgrade to OpenShift version 4.8.0 or later.
What systems are affected by CVE-2021-3636?
CVE-2021-3636 affects OpenShift versions prior to 4.8.
What impact does CVE-2021-3636 have on security?
CVE-2021-3636 can potentially allow unauthorized access to in-cluster services due to the inclusion of additional certificates.
When was CVE-2021-3636 discovered?
CVE-2021-3636 was disclosed as a vulnerability affecting OpenShift prior to version 4.8.