CVE-2021-3684

2023-03-2400:00:00

CWE-532

redhat

www.cve.org

openshift

assisted installer

vulnerability

image pull secrets

leakage

plaintext

installation logs

authenticated user

exploit

container images

registry

AI Score

5.7

Confidence

High

EPSS

Percentile

15.5%

JSON

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "assisted-installer",
    "versions": [
      {
        "version": "openshift/assisted-installer 1.0.25.1, openshift/assisted-installer 2.0.0",
        "status": "affected"
      }
    ]
  }
]