Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/coreos/ignition

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoPublished

    Ignition config accessible to unprivileged software on VMware

    CVE-2022-1706 · GHSA-hj57-j5cw-2mwp

    Affected
    • Go github.com/coreos/ignition <= 0.35.0
    Fixed in
    2.14.0· Vendor fix available
    Issue
    Impact Unprivileged software in VMware VMs, including software running in unprivileged containers, can retrieve an Ignition config stored in a hypervisor guestinfo variable or OVF environment. If the Ignition config contains secrets, this can result in the compromise of sensitive information. Patches Ignition 2.14.0 and later adds a new systemd service, ignition-delete-config.service, that deletes the Ignition config from supported hypervisors (currently VMware and VirtualBox) during the first boot. This ensures that unprivileged software cannot retrieve the Ignition config from the hypervisor. If you have external tooling that requires the Ignition config to remain accessible in VM metadata after provisioning, and your Ignition config does not include sensitive information, you can prevent Ignition 2.14.0 and later from deleting the config by masking ignition-delete-config.service. For example: Workarounds Avoid storing secrets in Ignition configs. In addition to VMware, many cloud…

    Recommended action: Upgrade to 2.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →