CVE-2021-20319

CVE-2021-20319 affects coreos-installer. The issue is an improper signature verification for gzip-install images, allowing a modified image to bypass verification and install unsigned content. This can enable arbitrary data writes and full access to the installed node. Public references in NVD de...

CVE-2021-3917

CVE-2021-3917 describes a vulnerability in the coreos-installer where the Ignition config is written to the target with world-readable permissions, exposing potentially sensitive data. The primary impact is confidentiality, with a local attacker able to read data due to overly permissive file per...