CVE-2021-20319CWE-347

An improper signature verification vulnerability was found in coreos-installer

published March 4, 2022

CVSS
—
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.2th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2022-03-04T17:05Z
EPSS history
Timeline
  • 04 MAR 17:05Z
    An improper signature verification vulnerability was found in coreos-installer
    cvelistv5