CVE-2021-3636
It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.
- Affected products
- Openshift
- Redhat Openshift
- < 4.8
- Fix
- Available
- CVSS 3.1
- 4.6 MEDIUM
- EPSS
- 0.3% (21th percentile)
- Weakness
- CWE-287, CWE-295
- NVD status
- Modified
- Published
- 2021-07-30
CVE-2021-3636 at NVD
No indexed exploits for CVE-2021-3636 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-3636 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.