PT-2023-12303 · Red Hat · Openshift Assisted Installer

Michael Kaplan · Published 2023-03-24 · Updated 2023-04-03 · CVE-2021-3684

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenShift Assisted Installer (affected versions not specified)

Description A vulnerability was found in OpenShift Assisted Installer where image pull secrets were leaked as plaintext in the installation logs during the generation of the Discovery ISO. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2021-3684

GHSA-G8XM-P2H4-V6JP

Affected Products

Openshift Assisted Installer

References · 8

• https://github.com/openshift/assisted-installer/commit/2403dad3795406f2c5d923af0894e07bc8b0bdc4 · Patch
• https://github.com/openshift/assisted-installer/commit/f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a · Patch
• https://osv.dev/vulnerability/GHSA-g8xm-p2h4-v6jp · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1985962 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3684 · Security Note
• https://github.com/openshift/assisted-installer · Note
• https://t.me/cibsecurity/60710 · Telegram Post