CVE-2021-20319: An improper signature verification vulnerability was found in coreos-installer.

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• n/a coreos-installer

  • Affects coreos-installer before v0.10.1, Fixed in v0.10.1.affected

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• redhat coreos-installerbefore 0.10.1

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-3917A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions.
  22Monitor

Root cause

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const claims = jwt.verify(token, publicKey);

1const claims = jwt.verify(token, publicKey, {2  algorithms: ["RS256"],3  issuer: "https://id.example.com",4  audience: "portal",5});

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.