Lucene search

[email protected]CVE-2021-3636

HistoryJul 30, 2021 - 8:15 p.m.

CVE-2021-3636

2021-07-3020:15:07

CWE-287

CWE-295

[email protected]

web.nvd.nist.gov

openshift

service ca

certificate

version 4.8

additional cas

masquerade

nvd

4.1 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:S/C:P/I:P/A:N

4.6 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.0%

JSON

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.

Affected configurations

Vulners

NVD

Node

redhatopenshiftRange≤4.8

VendorProductVersionCPE
redhatopenshift*cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openshift	*	cpe:2.3:a:redhat:openshift::::::::

CNA Affected

[
  {
    "product": "openshift",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "openshift 4.8"
      }
    ]
  }
]