CVE-2021-3917

Katalog CVE

CVSS 5.5 · Medium EPSS 0,23%

Kerentanan Incorrect Default Permissions pada redhat coreos-installer. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.

Rincian

Terbit di NVD

23 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-3917 patch · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2018478 issue tracking · advisory vendor
• https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c patch · advisory pihak ketiga
• https://github.com/coreos/fedora-coreos-tracker/issues/889 issue tracking · patch · advisory pihak ketiga