Bug 1985962 (CVE-2021-3684) - CVE-2021-3684 assisted-installer: Image Pull Secret leaked through log files
Summary: CVE-2021-3684 assisted-installer: Image Pull Secret leaked through log files
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-3684
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1989899 1991803
Blocks: 1985966
TreeView+ depends on / blocked
 
Reported: 2021-07-26 11:30 UTC by Michael Kaplan
Modified: 2022-10-19 04:57 UTC (History)
7 users (show)

Fixed In Version: openshift/assisted-installer 1.0.25.1, openshift/assisted-installer 2.0.0
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
Clone Of:
Environment:
Last Closed: 2022-10-19 04:28:57 UTC
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2021-07-26 11:30:06 UTC 
A vulnerability was found in the Openshift API - Assisted Installer application. The Discovery ISO leaks the Image Pull Secret through several log files.
Comment 1 liat gamliel 2021-08-03 07:56:31 UTC 
@mkaplan can you share in which logs you see the pull secret details?
Comment 7 liat gamliel 2021-08-11 07:13:54 UTC 
Fixed by 
https://issues.redhat.com/browse/MGMT-7450
https://issues.redhat.com/browse/MGMT-7452
Comment 8 mlammon 2021-09-01 19:23:34 UTC 

I have downloaded a recent AI install (Assisted-ui-lib version: 1.5.34)

I checked all the log folder with DumpsterDriver (cool tool!) and found not issue.

python3 DumpsterDiver.py -p /tmp/junk/logs_host_f9fa0a82-7c54-4d58-bcaf-4fb080442cf2 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_a206dca4-25dc-4c7c-b28f-198b93f2170d --max-key=200 --min-key 100 --entropy 5
python3 DumpsterDiver.py -p /tmp/junk/logs_host_60f12793-739a-4730-85bd-a50b3cd31e91 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_5c77f6fb-bbf4-4b80-9ce7-207255f61071 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_08bf447b-afa5-4183-9253-368082726516 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_05a36f25-725d-47cf-9dc2-ef7d9201fe4f --max-key=200 --min-key 100 --entropy 5

python3 DumpsterDiver.py -p /tmp/junk/assisted-installer-controller-h2zlf.logs --max-key=200 --min-key 100 --entropy 5

 

I also used 'grep -r PullSecretToken' and I am not seeing any exposure
Comment 9 mlammon 2021-09-01 19:24:23 UTC 

I have downloaded a recent AI install (Assisted-ui-lib version: 1.5.34)

I checked all the log folder with DumpsterDriver (cool tool!) and found not issue.

python3 DumpsterDiver.py -p /tmp/junk/logs_host_f9fa0a82-7c54-4d58-bcaf-4fb080442cf2 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_a206dca4-25dc-4c7c-b28f-198b93f2170d --max-key=200 --min-key 100 --entropy 5
python3 DumpsterDiver.py -p /tmp/junk/logs_host_60f12793-739a-4730-85bd-a50b3cd31e91 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_5c77f6fb-bbf4-4b80-9ce7-207255f61071 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_08bf447b-afa5-4183-9253-368082726516 --max-key=200 --min-key 100 --entropy 5
 python3 DumpsterDiver.py -p /tmp/junk/logs_host_05a36f25-725d-47cf-9dc2-ef7d9201fe4f --max-key=200 --min-key 100 --entropy 5

python3 DumpsterDiver.py -p /tmp/junk/assisted-installer-controller-h2zlf.logs --max-key=200 --min-key 100 --entropy 5

 

I also used 'grep -r PullSecretToken' and I am not seeing any exposure
Comment 12 liat gamliel 2022-04-10 21:51:59 UTC 
*** Bug 1991803 has been marked as a duplicate of this bug. ***
Comment 13 Sam Fowler 2022-10-06 00:16:47 UTC 
Upstream fixes:

https://github.com/openshift/assisted-installer/commit/f3800cfa3d64ce6dcd6f7b73f0578bb99bfdaf7a
https://github.com/openshift/assisted-installer/commit/2403dad3795406f2c5d923af0894e07bc8b0bdc4
Comment 14 Sam Fowler 2022-10-19 04:28:57 UTC 
This issue has been addressed in the following products:

  OpenShift Assisted Installer

Via RHEA-2021:3455 https://access.redhat.com/errata/RHEA-2021:3455
Comment 15 Sam Fowler 2022-10-19 04:31:14 UTC 
This issue has been addressed in the following products:

  OpenShift Assisted Installer

Via RHEA-2021:3455 https://access.redhat.com/errata/RHEA-2021:3455
Note You need to log in before you can comment on or make changes to this bug.