Skip to content
Fencer Vulns
high 7.8

CVE-2021-20319 json

coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

published 2021-10-12 5 y ago modified 2026-09-10 1 mo ago also GHSA-3r3g-g73x-g593 , RUSTSEC-2022-0103 , EUVD-2021-2149

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.

Patch / fix

  • crates.io coreos-installer 0.10.1
  • redhat coreos-installer 0.10.1
  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2021:4008RHSA-2021:3926RHSA-2021:3930RHSA-2021:3934

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-20319 updated cvss 7.5

coreos-installer: incorrect signature verification on gzip-compressed install images

  • Red Hat OpenShift Container Platform 4.6 coreos-installer 0.6.0-4.rhaos4.6.el8, coreos-installer-bootinfra 0.6.0-4.rhaos4.6.el8
    fixed: vendor fix RHSA-2021:4008
  • Red Hat OpenShift Container Platform 4.7 coreos-installer 0.8.0-4.rhaos4.7.el8, coreos-installer-bootinfra 0.8.0-4.rhaos4.7.el8
    fixed: vendor fix RHSA-2021:3930
  • Red Hat OpenShift Container Platform 4.8 coreos-installer 0.9.0-7.rhaos4.8.el8, coreos-installer-bootinfra 0.9.0-7.rhaos4.8.el8
    fixed: vendor fix RHSA-2021:3926
  • Red Hat OpenShift Container Platform 4.9 coreos-installer 0.10.1-1.rhaos4.9.el8, coreos-installer-bootinfra 0.10.1-1.rhaos4.9.el8
    fixed: vendor fix RHSA-2021:3934
  • Red Hat OpenShift Container Platform 4.10 coreos-installer 0.12.0-1.rhaos4.10.el8, coreos-installer-bootinfra 0.12.0-1.rhaos4.10.el8
    fixed: vendor fix RHSA-2022:0055
  • Red Hat OpenShift Container Platform 4.6 podman 1.9.3-4.rhaos4.6.el8, podman-tests 1.9.3-4.rhaos4.6.el8, podman-docker 1.9.3-4.rhaos4.6.el8, podman-remote 1.9.3-4.rhaos4.6.el8, cri-o 1.19.4-4.rhaos4.6.git5d5a465.el7, cri-o 1.19.4-4.rhaos4.6.git5d5a465.el8 Red Hat OpenShift Container Platform 4.7 ironic-images 15.2-20211013.1.el8, ironic-images-all 15.2-20211013.1.el8, cri-o 1.20.5-6.rhaos4.7.gitec973a2.el7, cri-o 1.20.5-6.rhaos4.7.gitec973a2.el8, ironic-images-ipa-x86_64 15.2-20211013.1.el8, ironic-images-ipa-ppc64le 15.2-20211013.1.el8, +2 more Red Hat OpenShift Container Platform 4.8 ovn2.13 20.12.0-183.el8fdp, ovn2.13-host 20.12.0-183.el8fdp, ovn2.13-vtep 20.12.0-183.el8fdp, ovn2.13-central 20.12.0-183.el8fdp, cri-o 1.21.3-8.rhaos4.8.git7415a53.el7, cri-o 1.21.3-8.rhaos4.8.git7415a53.el8, +9 more Red Hat OpenShift Container Platform 4.9 cri-o 1.22.0-74.rhaos4.9.gitd745cab.el8, cri-o 1.22.0-89.rhaos4.9.gitd745cab.el7, openstack-ironic 18.1.1-0.20211006122217.5134847.el8, openstack-ironic-api 18.1.1-0.20211006122217.5134847.el8, python3-ironic-tests 18.1.1-0.20211006122217.5134847.el8, openstack-ironic-common 18.1.1-0.20211006122217.5134847.el8, +5 more Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +163 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
crates.io coreos-installer
<0.10.1
>=0.0.0-0, <0.10.1
0.10.1

Affected products

  • n/a coreos-installer

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.