Medium severity · published Mar 24, 2023
CVE-2021-3684
A vulnerability was found in OpenShift Assisted Installer
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Openshift Assisted Installer · Redhat
before 1.0.25.3 · source: NVD
OC
Openshift Container Platform · Redhat
4.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3684
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1985962
Patch
https://github.com/openshift/assisted-installer/commit/2403dad3795406f2c5d923af0894e07bc8b0bdc4
Patch
https://github.com/openshift/assisted-installer/commit/f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a