Description
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | coreos-installer | Fixed in coreos-installer 0.10.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | coreos-installer | 0.9.0-8.rhaos4.8.el8 | RHSA-2021:4829, RHSA-2021:3758 |
| Red Hat OpenShift 4 | coreos-installer-bootinfra | 0.10.0-2.rhaos4.9.el8 | RHSA-2021:3758 |
| Red Hat OpenShift 4 | jenkins | 2.289.3.1630554997-1.el8 | RHSA-2021:4829, RHSA-2021:3758 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.8.1637599935-1.el8 | RHSA-2021:4829 |
| Red Hat OpenShift 4 | openshift +1 | 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 | RHSA-2021:3758 |
| Red Hat OpenShift 4 | openvswitch2.15 +5 | 2.15.0-28.el8fdp | RHSA-2021:3758 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | coreos-installer | < 0.10.0 | 0.10.0 | GHSA-862g-9h5m-m3qv |
Advisories 2
- RHSA-2021:3758 Red Hat Security Advisory: OpenShift Container Platform 4.9.0 packages and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:4829 Red Hat Security Advisory: OpenShift Container Platform 4.8.22 security update Red Hat Security Advisories (RHSA) · Aug 12, 2026