Vulnerability · Published Feb 23, 2021 · Assigned by redhat

CVE-2021-20198

High 8.1

In plain English

A high-severity missing authentication in openshift/installer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS NVD)8.1High

Exploit odds (30 days)1.8%top 21.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this port during installation can make unauthenticated `/exec` requests to execute arbitrary commands within running containers. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected products (as reported)

Vendor	Product	Versions
n/a	openshift/installer	openshift/installer v0.9.0-master.0.20210125200451-95101da940b0

Weakness: CWE-306

References

https://bugzilla.redhat.com/show_bug.cgi?id=1920764 x_refsource_MISC