Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for ignition by redhat

    CVE-2022-1706 (GCVE-0-2022-1706)

    Vulnerability from nvd – Published: 2022-05-17 00:00 – Updated: 2024-08-03 00:10
    VLAI
    Summary
    A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a coreos/ignition Affected: Fixed in coreos/ignition v2.14.0
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.921Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2082274"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/issues/1300"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/issues/1315"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/pull/1350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/commit/4b70b44b430ecf8377a276e89b5acd3a6957d4ea"
          },
          {
            "name": "FEDORA-2022-393948cc9e",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NP765L7TJI7CD4XVOHUWZVRYRH3FYBOR/"
          },
          {
            "name": "FEDORA-2022-7846cac830",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LY7LKGMQMXV6DGD263YQHNSLOJJ5VLV5/"
          },
          {
            "name": "FEDORA-2022-5df5dc8ec5",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5QQXRGQKTN4YX2ZF3GQNEBDEOKJGCN3/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coreos/ignition",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in coreos/ignition v2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 - Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2082274"
        },
        {
          "url": "https://github.com/coreos/ignition/issues/1300"
        },
        {
          "url": "https://github.com/coreos/ignition/issues/1315"
        },
        {
          "url": "https://github.com/coreos/ignition/pull/1350"
        },
        {
          "url": "https://github.com/coreos/ignition/commit/4b70b44b430ecf8377a276e89b5acd3a6957d4ea"
        },
        {
          "name": "FEDORA-2022-393948cc9e",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NP765L7TJI7CD4XVOHUWZVRYRH3FYBOR/"
        },
        {
          "name": "FEDORA-2022-7846cac830",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LY7LKGMQMXV6DGD263YQHNSLOJJ5VLV5/"
        },
        {
          "name": "FEDORA-2022-5df5dc8ec5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5QQXRGQKTN4YX2ZF3GQNEBDEOKJGCN3/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-1706",
    "datePublished": "2022-05-17T00:00:00.000Z",
    "dateReserved": "2022-05-13T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2022-1706 (GCVE-0-2022-1706)

    Vulnerability from cvelistv5 – Published: 2022-05-17 00:00 – Updated: 2024-08-03 00:10
    VLAI
    Summary
    A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
    Severity
    No CVSS data available.
    CWE
    • CWE-863 - - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Vendor Product Version
    n/a coreos/ignition Affected: Fixed in coreos/ignition v2.14.0
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:10:03.921Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2082274"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/issues/1300"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/issues/1315"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/pull/1350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/coreos/ignition/commit/4b70b44b430ecf8377a276e89b5acd3a6957d4ea"
          },
          {
            "name": "FEDORA-2022-393948cc9e",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NP765L7TJI7CD4XVOHUWZVRYRH3FYBOR/"
          },
          {
            "name": "FEDORA-2022-7846cac830",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LY7LKGMQMXV6DGD263YQHNSLOJJ5VLV5/"
          },
          {
            "name": "FEDORA-2022-5df5dc8ec5",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5QQXRGQKTN4YX2ZF3GQNEBDEOKJGCN3/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "coreos/ignition",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in coreos/ignition v2.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 - Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2082274"
        },
        {
          "url": "https://github.com/coreos/ignition/issues/1300"
        },
        {
          "url": "https://github.com/coreos/ignition/issues/1315"
        },
        {
          "url": "https://github.com/coreos/ignition/pull/1350"
        },
        {
          "url": "https://github.com/coreos/ignition/commit/4b70b44b430ecf8377a276e89b5acd3a6957d4ea"
        },
        {
          "name": "FEDORA-2022-393948cc9e",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NP765L7TJI7CD4XVOHUWZVRYRH3FYBOR/"
        },
        {
          "name": "FEDORA-2022-7846cac830",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LY7LKGMQMXV6DGD263YQHNSLOJJ5VLV5/"
        },
        {
          "name": "FEDORA-2022-5df5dc8ec5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5QQXRGQKTN4YX2ZF3GQNEBDEOKJGCN3/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-1706",
    "datePublished": "2022-05-17T00:00:00.000Z",
    "dateReserved": "2022-05-13T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:10:03.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}