Skip to content
Fencer Vulns
medium 4.6

CVE-2021-3636 json

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additiona…

published 2021-07-30 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26937

cvss
4.6
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.

Patch / fix

  • redhat openshift 4.8
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el7
  • runc openshift 4.8 1.0.0-98.rhaos4.8.gitcd80260.el8
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el7
  • cri-o openshift 4.8 1.21.2-5.rhaos4.8.gitb27d974.el8
  • butane openshift 4.8 0.12.1-1.rhaos4.8.el8
  • ostree openshift 4.8 2020.7-5.el8_4
  • podman openshift 4.8 3.0.1-6.el8
  • haproxy openshift 4.8 2.2.13-1.el7

red hat advisories RHSA-2021:2437

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3636 updated cvss 4.6

openshift: Injected service-ca.crt incorrectly contains additional internal CAs

  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.8 openshift 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, openshift 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8, openshift-hyperkube 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el7, openshift-hyperkube 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8
    fixed: vendor fix RHSA-2021:2437
  • Red Hat OpenShift Container Platform 4.8 podman 3.0.1-6.el8, haproxy 2.2.13-1.el7, haproxy 2.2.13-1.el8, ostree 2020.7-5.el8_4, cri-tools 1.21.0-2.el7, cri-tools 1.21.0-2.el8, +130 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1978621 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 4.1 AV:A/AC:L/Au:S/C:P/I:P/A:N

Affected products

  • n/a openshift

Classification

Weakness
  • CWE-295 Improper Certificate Validation
  • CWE-287 Improper Authentication

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.