2 results · Feed
-
Medium 5.5
coreos-installer < 0.10.0 writes world-readable Ignition config to installed system
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulner…
-
High 7.8
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to …