CVEvulnerability
CVE-2021-3684
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-03-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-532
Description
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
Affected configurations
• redhat openshift assisted installer (< 1.0.25.3)
• redhat openshift container platform 4.6
Related
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1985962 Issue Tracking, Patch, Vendor Advisory
- https://github.com/openshift/assisted-installer/commit/2403dad3795406f2c5d923af0894e07bc8b0bdc4 Patch
- https://github.com/openshift/assisted-installer/commit/f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=1985962 Issue Tracking, Patch, Vendor Advisory
- https://github.com/openshift/assisted-installer/commit/2403dad3795406f2c5d923af0894e07bc8b0bdc4 Patch
- https://github.com/openshift/assisted-installer/commit/f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a Patch