{"cve":"CVE-2021-20319","nvd":{"published":"2022-03-04T18:15:08.060","modified":"2026-06-17T03:33:39.947","status":"Modified","description":"An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-347"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=2011862","https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89","https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593","https://bugzilla.redhat.com/show_bug.cgi?id=2011862","https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89"],"products":["redhat:coreos-installer"],"source":"nvd","synced_at":"2026-10-19T21:28:04.509275555+00:00"},"epss":{"cve":"CVE-2021-20319","score":0.00519,"percentile":0.44118,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3r3g-g73x-g593","url":"https://osv.dev/vulnerability/GHSA-3r3g-g73x-g593","summary":"coreos-installer improperly verifies GPG signature when decompressing gzipped artifact","modified":"2026-09-10T03:49:08.951357435Z","packages":[{"ecosystem":"crates.io","name":"coreos-installer","purl":"pkg:cargo/coreos-installer","ranges":["<0.10.1"],"fixed":["0.10.1"]}]},{"id":"RUSTSEC-2022-0103","url":"https://osv.dev/vulnerability/RUSTSEC-2022-0103","summary":"Incorrect signature verification on gzip-compressed install images","modified":"2025-12-21T14:11:01.036603Z","packages":[{"ecosystem":"crates.io","name":"coreos-installer","purl":"pkg:cargo/coreos-installer","ranges":[">=0.0.0-0 <0.10.1"],"fixed":["0.10.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}