Read the docs
TI-2021-02623 Aliases CVE-2021-3684GHSA-g8xm-p2h4-v6jp

Sensitive information in log files in assisted-installer

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed github.com/openshift/assisted-installer (Go): 1.0.25.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—assisted-installeropenshift/assisted-installer 1.0.25.1, openshift/assisted-installer 2.0.0—No fix listedCNA
—github.com/openshift/assisted-installer (Go)before 1.0.25.11.0.25.1Patch availableGHSA-g8xm-p2h4-v6jp
  • assisted-installer Vendor— Affected openshift/assisted-installer 1.0.25.1, openshift/assisted-installer 2.0.0 Fixed in — No fix listed CNA
  • github.com/openshift/assisted-installer (Go) Vendor— Affected before 1.0.25.1 Fixed in 1.0.25.1 Patch available GHSA-g8xm-p2h4-v6jp

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_assisted_installer:*:*:*:*:*:*:*:*before 1.0.25.3VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
  • cpe:2.3:a:redhat:openshift_assisted_installer:*:*:*:*:*:*:*:* Versions before 1.0.25.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat

Remediation

  • Fix · GHSA-g8xm-p2h4-v6jp github.com/openshift/assisted-installer (Go) Fixed in 1.0.25.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Assisted Installer 1.0Fixed—
Not affected: 1 product
  • Red Hat Assisted Installer 1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3684
  2. 2026-10-03 Alias added: GHSA-g8xm-p2h4-v6jp

References

Patch 3

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences