CVE-2021-20319
High
Description
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Redhat Coreos-installer
PublishedMar 4, 2022
First seenMar 4, 2022
Weakness typeCWE-347CWE-347
How to fix
Update
- redhat coreos-installer0.10.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat coreos-installer | v < 0.10.1 | 0.10.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.