Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-1706 EUVD-2022-4168GHSA-hj57-j5cw-2mwpGO-2022-0451

Ignition config accessible to unprivileged software on VMware

Published May 17, 2022 · Updated Aug 3, 2024 · Assigned by redhat

Package: cluster-api-aws-controller Package: github.com/coreos/ignition Package: github.com/coreos/ignition/v2 Package: ignition Package: ignition Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.

Affected products

VendorProductAffectedFixed
— coreos/ignition Fixed in coreos/ignition v2.14.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ignition 2.14.0+ds1-1 —
Debian 13 ignition 2.14.0+ds1-1 —
Debian 12 ignition 2.14.0+ds1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ignition No fix yet —
Ubuntu 26.04 LTS ignition No fix yet —
Ubuntu 25.10 ignition No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS ignition No fix yet —
Ubuntu Pro 22.04 LTS ignition No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 ignition 2.14.0-1.el9 RHSA-2022:8126
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 libsodium +2 1.0.16-5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 openstack-ironic +4 1:20.2.1-0.20220628175043.b5ed57a.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 openstack-ironic-inspector +4 10.12.1-0.20220513095437.6dd37e5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 pycdlib-tools +2 1.11.0-4.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 pyparsing +2 2.3.1-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 pysnmp +1 4.4.8-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-SecretStorage +1 2.3.1-9.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-alembic +1 1.4.2-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-amqp +2 2.5.2-8.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-appdirs +1 1.4.0-8.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-automaton +1 2.5.0-0.20220509195848.aaca110.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-bcrypt +1 3.1.6-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-beautifulsoup4 +1 4.9.3-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-cachetools +1 3.1.0-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-cinderclient +1 8.3.0-0.20220509212734.ee59b68.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-cliff +2 3.10.1-0.20220509200732.a04a48f.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-colorama +1 0.4.1-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-construct +1 2.10.56-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-dataclasses +1 0.8-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-debtcollector +1 2.5.0-0.20220509211533.a6b46c5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-decorator +1 4.4.0-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-dogpile-cache +1 1.1.2-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-dracclient +1 8.0.0-0.20220509201613.9c7499c.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-editor +1 1.0.4-5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-fasteners +1 0.14.1-21.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-flask +2 1:1.1.1-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-funcsigs +1 1.0.2-17.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-futurist +1 2.4.1-0.20220509215250.159d752.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-glanceclient +1 1:3.6.0-0.20220509212414.626c500.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-greenlet +2 0.4.14-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-hardware +2 0.29.0-0.20220216015636.7662a1d.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-ifaddr +1 0.1.6-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-importlib-metadata +1 1.7.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-ironic-lib +1 5.1.1-0.20220225151335.e205816.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-ironic-prometheus-exporter +1 3.1.1-0.20220324125409.db1a824.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-iso8601 +1 0.1.12-9.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-jsonpath-rw +1 1.2.3-23.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-jsonschema +1 3.2.0-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-kazoo +1 2.7.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-keyring +1 21.0.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-keystoneauth1 +1 4.5.0-0.20220509213157.8da0a63.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-keystoneclient +2 1:4.4.0-0.20220509200759.100253d.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-keystonemiddleware +1 9.4.0-0.20220509211054.8a05709.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-kombu +1 1:4.6.6-8.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-logutils +1 0.3.5-7.1.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-memcached +1 1.58-12.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-migrate +1 0.13.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-msgpack +1 0.6.2-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-munch +1 2.3.2-7.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-openstacksdk +2 0.61.0-0.20220509201549.26c9bc2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-os-service-types +1 1.7.0-0.20220215231659.0b2f473.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-os-traits +2 2.7.0-0.20220509205801.3d1dbf0.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-osc-lib +2 2.5.0-0.20220509211843.78d276e.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-cache +3 2.8.1-0.20220216000746.40946a9.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-concurrency +3 4.5.1-0.20220509221157.145f060.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-config +1 2:8.8.0-0.20220509202553.64c82a0.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-context +2 4.1.0-0.20220509205437.3400cc2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-db +3 9.1.0-0.20220216003829.be2cc6a.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-i18n +2 5.1.0-0.20220216011159.b031d17.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-log +3 4.6.0-0.20220216002407.41c8807.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-messaging +2 12.13.0-0.20220509210748.2d090b5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-metrics +2 0.3.0-0.20220216012738.43eee50.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-middleware +3 4.5.1-0.20220509203328.2f72b30.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-policy +3 3.12.1-0.20220509221328.9673a74.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-rootwrap +2 6.3.1-0.20220509204453.1b1b960.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-serialization +2 4.3.0-0.20220509195921.6910f75.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-service +2 2.8.0-0.20220509203713.6552b9a.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-upgradecheck +1 1.5.0-0.20220509195112.1559e03.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-utils +3 4.13.0-0.20220509213520.de4429f.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-oslo-versionedobjects +3 2.6.0-0.20220509202736.25d34d6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-osprofiler +1 3.4.3-0.20220509214403.3286301.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-packaging +2 20.4-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-paste +1 3.2.4-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-paste-deploy +1 2.0.1-5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pbr +1 5.5.1-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pecan +1 1.3.2-10.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pexpect +1 4.6-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pint +1 0.10.1-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-proliantutils +1 2.13.2-0.20220509214147.8c7b6b1.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-prometheus_client +1 0.7.1-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pycadf +2 3.1.1-0.20220215232623.4179996.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pynacl +1 1.3.0-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pyperclip +2 1.6.4-7.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-pyrsistent +1 0.16.0-4.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-redis +1 3.3.8-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-repoze-lru +1 0.7-7.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-requestsexceptions +1 1.4.0-0.20220215231659.d7ac0ff.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-retrying +1 1.2.3-22.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-rfc3986 +1 1.2.0-6.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-routes +1 2.4.1-12.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-scciclient 0.11.1-0.20220216020832.a84332b.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-simplegeneric 0.8.1-18.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-simplejson 3.17.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-singledispatch 3.4.0.3-19.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-six 1.15.0-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-soupsieve 2.1.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-sqlparse 0.2.4-10.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-statsd 3.2.1-17.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-stevedore 3.5.0-0.20220509195112.442f157.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-sushy 4.1.1-0.20220302175405.c769149.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-sushy-oem-idrac 4.0.0-0.20220324125409.7b75e6e.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-swiftclient 3.13.1-0.20220509204112.4989d94.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-tempita 0.5.1-25.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-tenacity 6.2.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-tooz 2.11.1-0.20220509215238.96f91b9.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-vine 1.3.0-5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-voluptuous 0.11.7-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-waitress 2.0.0-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-warlock 1.3.3-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-wcwidth 0.1.7-15.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-webob 1.8.5-5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-webtest 2.0.33-5.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-werkzeug 2.0.3-1.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-wrapt +1 1.11.2-4.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-wsme 0.11.0-0.20220216004816.80bda90.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-yappi 1.0-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-zake 0.2.2-19.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-zeroconf 0.24.4-2.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python-zipp 0.5.1-3.el8 RHSA-2022:5068
Red Hat Openshift Ironic 4 python3-ironic-python-agent +1 8.6.1-0.20220623075054.1d50c23.el8 RHSA-2022:5068
Red Hat OpenShift 4 afterburn +1 5.3.0-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 atomic-openshift-service-idler 4.11.0-202206222028.p0.g39cfc66.assembly.stream.el8 RHSA-2022:5068
Red Hat OpenShift 4 bootupd +1 0.2.5-3.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 buildah +1 1:1.23.4-2.el8 RHSA-2022:5068
Red Hat OpenShift 4 butane +1 0.15.0-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 conmon 2:2.1.2-2.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.3-2.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 container-selinux 2:2.188.0-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-5.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 containers-common 2:1-21.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 coreos-installer +1 0.15.0-2.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 cri-o 1.24.1-11.rhaos4.11.gitb0d2ef3.el8 RHSA-2022:5068
Red Hat OpenShift 4 cri-tools 1.24.2-4.1.el8 RHSA-2022:5068
Red Hat OpenShift 4 crit +4 3.15-4.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 crun 1.4.2-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 fuse-overlayfs 1.9-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 haproxy +1 2.2.24-1.el8 RHSA-2022:5068
Red Hat OpenShift 4 ignition +1 2.14.0-3.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 kata-containers 2.4.2-1.el8 RHSA-2022:5068
Red Hat OpenShift 4 libslirp +1 4.4.0-2.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 openshift +1 4.11.0-202207082037.p0.g9546431.assembly.stream.el8 RHSA-2022:5068
Red Hat OpenShift 4 openshift-ansible +1 4.11.0-202206240216.p0.g9de1722.assembly.stream.el8 RHSA-2022:5068
Red Hat OpenShift 4 openshift-clients +1 4.11.0-202207291716.p0.g7075089.assembly.stream.el8 RHSA-2022:5068
Red Hat OpenShift 4 openshift-kuryr +4 4.11.0-202206232036.p0.g66c0cec.assembly.stream.el8 RHSA-2022:5068
Red Hat OpenShift 4 openvswitch2.17 +5 2.17.0-22.el8fdp RHSA-2022:5068
Red Hat OpenShift 4 ovn22.03 +3 22.03.0-37.el8fdp RHSA-2022:5068
Red Hat OpenShift 4 ovn22.06 +3 22.06.0-27.el8fdp RHSA-2022:5068
Red Hat OpenShift 4 podman +5 2:4.0.2-6.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 runc 3:1.1.2-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 skopeo +1 2:1.5.2-3.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 slirp4netns 1.1.8-1.rhaos4.11.el8 RHSA-2022:5068
Red Hat OpenShift 4 toolbox 0.0.9-1.rhaos4.11.el8 RHSA-2022:5068

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 ignition 2.14.0-1.el9 ALSA-2022:8126

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 ignition 2.14.0-1.el9 RLSA-2022:8126

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-1
SLES 15 SP3 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 5.2 ignition 2.14.0-150300.6.7.1 SUSE-SU-2022:2349-1
SLE Micro 5.2 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-1
SLE Micro 5.1 ignition 2.14.0-150300.4.7.1 SUSE-SU-2022:2350-1
SLE Micro 5.1 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.4 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-1
openSUSE Leap 15.3 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.2 ignition 2.14.0-150300.6.7.1 SUSE-SU-2022:2349-2
openSUSE Leap Micro 5.2 systemd-presets-common-SUSE 15-150100.8.17.1 SUSE-SU-2022:2866-2

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 ignition 2.14.0-1.el9 ELSA-2022-8126

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cluster-api-aws-controller No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/coreos/ignition < 2.14.0 2.14.0 GHSA-hj57-j5cw-2mwp
Go github.com/coreos/ignition all versions — GO-2022-0451
Go github.com/coreos/ignition/v2 < 2.14.0 2.14.0 GHSA-hj57-j5cw-2mwp

Advisories 11

References