{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "Bootstrap nodes allow anonymous authentication on kubelet port 10250", "tracking": { "current_release_date": "2026-08-11T14:53:14+00:00", "generator": { "date": "2026-08-11T14:53:14+00:00", "engine": { "name": "CSAF Generator", "version": "3.3.0" } }, "id": "CVE-2021-20198", "initial_release_date": "2021-02-08T00:00:00+00:00", "revision_history": [ { "date": "2026-08-11T14:53:14+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "OpenShift Container Platform 4.4", "product": { "name": "OpenShift Container Platform 4.4", "product_id": "openshift-4.4.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.5", "product": { "name": "OpenShift Container Platform 4.5", "product_id": "openshift-4.5.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.5", "product": { "name": "OpenShift Container Platform 4.5", "product_id": "openshift-4.5::el7", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.5::el7" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.6", "product": { "name": "OpenShift Container Platform 4.6", "product_id": "openshift-4.6.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.6", "product": { "name": "OpenShift Container Platform 4.6", "product_id": "openshift-4.6::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.6::el8" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.7", "product": { "name": "OpenShift Container Platform 4.7", "product_id": "openshift-4.7", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 3.11.0", "product": { "name": "OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3" } } }, { "category": "product_version", "name": "atomic-openshift", "product": { "name": "atomic-openshift", "product_id": "atomic-openshift", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift" } } }, { "category": "product_version", "name": "atomic-openshift-clients", "product": { "name": "atomic-openshift-clients", "product_id": "atomic-openshift-clients", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients" } } }, { "category": "product_version", "name": "atomic-openshift-clients-redistributable", "product": { "name": "atomic-openshift-clients-redistributable", "product_id": "atomic-openshift-clients-redistributable", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable" } } }, { "category": "product_version", "name": "atomic-openshift-docker-excluder", "product": { "name": "atomic-openshift-docker-excluder", "product_id": "atomic-openshift-docker-excluder", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-docker-excluder" } } }, { "category": "product_version", "name": "atomic-openshift-dockerregistry", "product": { "name": "atomic-openshift-dockerregistry", "product_id": "atomic-openshift-dockerregistry", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-dockerregistry" } } }, { "category": "product_version", "name": "atomic-openshift-excluder", "product": { "name": "atomic-openshift-excluder", "product_id": "atomic-openshift-excluder", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-excluder" } } }, { "category": "product_version", "name": "atomic-openshift-hyperkube", "product": { "name": "atomic-openshift-hyperkube", "product_id": "atomic-openshift-hyperkube", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hyperkube" } } }, { "category": "product_version", "name": "atomic-openshift-hypershift", "product": { "name": "atomic-openshift-hypershift", "product_id": "atomic-openshift-hypershift", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-hypershift" } } }, { "category": "product_version", "name": "atomic-openshift-master", "product": { "name": "atomic-openshift-master", "product_id": "atomic-openshift-master", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master" } } }, { "category": "product_version", "name": "atomic-openshift-node", "product": { "name": "atomic-openshift-node", "product_id": "atomic-openshift-node", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node" } } }, { "category": "product_version", "name": "atomic-openshift-pod", "product": { "name": "atomic-openshift-pod", "product_id": "atomic-openshift-pod", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs", "product": { "name": "atomic-openshift-sdn-ovs", "product_id": "atomic-openshift-sdn-ovs", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs" } } }, { "category": "product_version", "name": "atomic-openshift-template-service-broker", "product": { "name": "atomic-openshift-template-service-broker", "product_id": "atomic-openshift-template-service-broker", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-template-service-broker" } } }, { "category": "product_version", "name": "atomic-openshift-tests", "product": { "name": "atomic-openshift-tests", "product_id": "atomic-openshift-tests", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests" } } }, { "category": "product_version", "name": "atomic-openshift", "product": { "name": "atomic-openshift", "product_id": "atomic-openshift.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift?arch=src" } } }, { "category": "product_version", "name": "openshift4/ose-installer", "product": { "name": "openshift4/ose-installer", "product_id": "openshift4/ose-installer", "product_identification_helper": { "purl": "pkg:oci/ose-installer?repository_url=registry.redhat.io/openshift4/ose-installer" } } }, { "category": "product_version", "name": "ose-installer-container-v4.5.0", "product": { "name": "ose-installer-container-v4.5.0", "product_id": "ose-installer-container-v4.5.0-0:202101301520.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-installer-container-v4.5.0@202101301520.p0?epoch=0" } } }, { "category": "product_version", "name": "ose-installer-container-v4.6.0", "product": { "name": "ose-installer-container-v4.6.0", "product_id": "ose-installer-container-v4.6.0-0:202101300140.p0", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-installer-container-v4.6.0@202101300140.p0?epoch=0" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift" }, "product_reference": "atomic-openshift", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-clients" }, "product_reference": "atomic-openshift-clients", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-clients-redistributable" }, "product_reference": "atomic-openshift-clients-redistributable", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-docker-excluder as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-docker-excluder" }, "product_reference": "atomic-openshift-docker-excluder", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-dockerregistry as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-dockerregistry" }, "product_reference": "atomic-openshift-dockerregistry", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-excluder as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-excluder" }, "product_reference": "atomic-openshift-excluder", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hyperkube as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-hyperkube" }, "product_reference": "atomic-openshift-hyperkube", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-hypershift as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-hypershift" }, "product_reference": "atomic-openshift-hypershift", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-master" }, "product_reference": "atomic-openshift-master", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-node" }, "product_reference": "atomic-openshift-node", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-pod" }, "product_reference": "atomic-openshift-pod", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-sdn-ovs" }, "product_reference": "atomic-openshift-sdn-ovs", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-template-service-broker as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-template-service-broker" }, "product_reference": "atomic-openshift-template-service-broker", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift-tests" }, "product_reference": "atomic-openshift-tests", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift.src as a component of OpenShift Container Platform 3.11.0", "product_id": "openshift-enterprise-3.11:atomic-openshift.src" }, "product_reference": "atomic-openshift.src", "relates_to_product_reference": "openshift-enterprise-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-installer as a component of OpenShift Container Platform 4.6", "product_id": "openshift-4.6.z:openshift4/ose-installer" }, "product_reference": "openshift4/ose-installer", "relates_to_product_reference": "openshift-4.6.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-installer as a component of OpenShift Container Platform 4.5", "product_id": "openshift-4.5.z:openshift4/ose-installer" }, "product_reference": "openshift4/ose-installer", "relates_to_product_reference": "openshift-4.5.z" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-installer as a component of OpenShift Container Platform 4.7", "product_id": "openshift-4.7:openshift4/ose-installer" }, "product_reference": "openshift4/ose-installer", "relates_to_product_reference": "openshift-4.7" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-installer as a component of OpenShift Container Platform 4.4", "product_id": "openshift-4.4.z:openshift4/ose-installer" }, "product_reference": "openshift4/ose-installer", "relates_to_product_reference": "openshift-4.4.z" }, { "category": "default_component_of", "full_product_name": { "name": "ose-installer-container-v4.5.0-0:202101301520.p0 as a component of OpenShift Container Platform 4.5", "product_id": "openshift-4.5::el7:ose-installer-container-v4.5.0-0:202101301520.p0" }, "product_reference": "ose-installer-container-v4.5.0-0:202101301520.p0", "relates_to_product_reference": "openshift-4.5::el7" }, { "category": "default_component_of", "full_product_name": { "name": "ose-installer-container-v4.6.0-0:202101300140.p0 as a component of OpenShift Container Platform 4.6", "product_id": "openshift-4.6::el8:ose-installer-container-v4.6.0-0:202101300140.p0" }, "product_reference": "ose-installer-container-v4.6.0-0:202101300140.p0", "relates_to_product_reference": "openshift-4.6::el8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-20198", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "discovery_date": "2021-01-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "openshift-enterprise-3.11:atomic-openshift", "openshift-enterprise-3.11:atomic-openshift-clients", "openshift-enterprise-3.11:atomic-openshift-clients-redistributable", "openshift-enterprise-3.11:atomic-openshift-docker-excluder", "openshift-enterprise-3.11:atomic-openshift-dockerregistry", "openshift-enterprise-3.11:atomic-openshift-excluder", "openshift-enterprise-3.11:atomic-openshift-hyperkube", "openshift-enterprise-3.11:atomic-openshift-hypershift", "openshift-enterprise-3.11:atomic-openshift-master", "openshift-enterprise-3.11:atomic-openshift-node", "openshift-enterprise-3.11:atomic-openshift-pod", "openshift-enterprise-3.11:atomic-openshift-sdn-ovs", "openshift-enterprise-3.11:atomic-openshift-template-service-broker", "openshift-enterprise-3.11:atomic-openshift-tests", "openshift-enterprise-3.11:atomic-openshift.src" ] } ], "notes": [ { "category": "description", "text": "A flaw was found in the OpenShift Installer. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this port during installation can make unauthenticated `/exec` requests to execute arbitrary commands within running containers. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "openshift-4.5::el7:ose-installer-container-v4.5.0-0:202101301520.p0", "openshift-4.6::el8:ose-installer-container-v4.6.0-0:202101300140.p0" ], "known_affected": [ "openshift-4.4.z:openshift4/ose-installer", "openshift-4.5.z:openshift4/ose-installer", "openshift-4.6.z:openshift4/ose-installer", "openshift-4.7:openshift4/ose-installer" ], "known_not_affected": [ "openshift-enterprise-3.11:atomic-openshift", "openshift-enterprise-3.11:atomic-openshift-clients", "openshift-enterprise-3.11:atomic-openshift-clients-redistributable", "openshift-enterprise-3.11:atomic-openshift-docker-excluder", "openshift-enterprise-3.11:atomic-openshift-dockerregistry", "openshift-enterprise-3.11:atomic-openshift-excluder", "openshift-enterprise-3.11:atomic-openshift-hyperkube", "openshift-enterprise-3.11:atomic-openshift-hypershift", "openshift-enterprise-3.11:atomic-openshift-master", "openshift-enterprise-3.11:atomic-openshift-node", "openshift-enterprise-3.11:atomic-openshift-pod", "openshift-enterprise-3.11:atomic-openshift-sdn-ovs", "openshift-enterprise-3.11:atomic-openshift-template-service-broker", "openshift-enterprise-3.11:atomic-openshift-tests", "openshift-enterprise-3.11:atomic-openshift.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-20198" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20198" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20198" } ], "remediations": [ { "category": "no_fix_planned", "details": "Out of support scope", "product_ids": [ "openshift-4.4.z:openshift4/ose-installer" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "openshift-4.5.z:openshift4/ose-installer", "openshift-4.6.z:openshift4/ose-installer", "openshift-4.7:openshift4/ose-installer" ] }, { "category": "vendor_fix", "date": "2021-02-08T13:49:53+00:00", "details": "Apply advisory RHSA-2021:0308 as per vendors instructions.", "product_ids": [ "openshift-4.6::el8:ose-installer-container-v4.6.0-0:202101300140.p0" ], "url": "https://access.redhat.com/errata/RHSA-2021:0308" }, { "category": "vendor_fix", "date": "2021-02-09T13:33:29+00:00", "details": "Apply advisory RHSA-2021:0313 as per vendors instructions.", "product_ids": [ "openshift-4.5::el7:ose-installer-container-v4.5.0-0:202101301520.p0" ], "url": "https://access.redhat.com/errata/RHSA-2021:0313" }, { "category": "workaround", "details": "This issue is mitigated by default on AWS, Azure, GCP and OpenStack as port 10250 is not remotely accessible on bootstrap nodes. For other IPI platforms, bootstrap nodes only exist during the installation window so the exposure is limited. For UPI installations, administrators should prevent remote access to this port on bootstrap nodes and/or remove the nodes once installation is complete", "product_ids": [ "openshift-4.4.z:openshift4/ose-installer", "openshift-4.5.z:openshift4/ose-installer", "openshift-4.6.z:openshift4/ose-installer", "openshift-4.7:openshift4/ose-installer" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "openshift-4.4.z:openshift4/ose-installer", "openshift-4.5.z:openshift4/ose-installer", "openshift-4.5::el7:ose-installer-container-v4.5.0-0:202101301520.p0", "openshift-4.6.z:openshift4/ose-installer", "openshift-4.6::el8:ose-installer-container-v4.6.0-0:202101300140.p0", "openshift-4.7:openshift4/ose-installer", "openshift-enterprise-3.11:atomic-openshift", "openshift-enterprise-3.11:atomic-openshift-clients", "openshift-enterprise-3.11:atomic-openshift-clients-redistributable", "openshift-enterprise-3.11:atomic-openshift-docker-excluder", "openshift-enterprise-3.11:atomic-openshift-dockerregistry", "openshift-enterprise-3.11:atomic-openshift-excluder", "openshift-enterprise-3.11:atomic-openshift-hyperkube", "openshift-enterprise-3.11:atomic-openshift-hypershift", "openshift-enterprise-3.11:atomic-openshift-master", "openshift-enterprise-3.11:atomic-openshift-node", "openshift-enterprise-3.11:atomic-openshift-pod", "openshift-enterprise-3.11:atomic-openshift-sdn-ovs", "openshift-enterprise-3.11:atomic-openshift-template-service-broker", "openshift-enterprise-3.11:atomic-openshift-tests", "openshift-enterprise-3.11:atomic-openshift.src" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "openshift-4.4.z:openshift4/ose-installer", "openshift-4.5.z:openshift4/ose-installer", "openshift-4.5::el7:ose-installer-container-v4.5.0-0:202101301520.p0", "openshift-4.6.z:openshift4/ose-installer", "openshift-4.6::el8:ose-installer-container-v4.6.0-0:202101300140.p0", "openshift-4.7:openshift4/ose-installer", "openshift-enterprise-3.11:atomic-openshift", "openshift-enterprise-3.11:atomic-openshift-clients", "openshift-enterprise-3.11:atomic-openshift-clients-redistributable", "openshift-enterprise-3.11:atomic-openshift-docker-excluder", "openshift-enterprise-3.11:atomic-openshift-dockerregistry", "openshift-enterprise-3.11:atomic-openshift-excluder", "openshift-enterprise-3.11:atomic-openshift-hyperkube", "openshift-enterprise-3.11:atomic-openshift-hypershift", "openshift-enterprise-3.11:atomic-openshift-master", "openshift-enterprise-3.11:atomic-openshift-node", "openshift-enterprise-3.11:atomic-openshift-pod", "openshift-enterprise-3.11:atomic-openshift-sdn-ovs", "openshift-enterprise-3.11:atomic-openshift-template-service-broker", "openshift-enterprise-3.11:atomic-openshift-tests", "openshift-enterprise-3.11:atomic-openshift.src" ] } ], "title": "Bootstrap nodes allow anonymous authentication on kubelet port 10250" } ] }