CVE-2021-20319GHSA-3R3G-G73X-G593RUSTSEC-2022-0103
An improper signature verification vulnerability was found in coreos-installer.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.10.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a coreos-installer
Version range not reported
- coreos-installercrates.io
fixed in 0.10.1
- coreos-installercrates.io
From 0.0.0-0 · fixed in 0.10.1