CVE-2021-3636

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificates signed by the trusted Service CA. The incorrect inclusion of additional CAs in this certificate would allow an attacker that compromises any of the additional CAs to masquerade as a trusted in-cluster service.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-295 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-363639.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.CVE-2021-363649.8Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.CVE-2021-363659.8Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.CVE-2021-363669.8Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.CVE-2021-363678.1PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it CVE-2021-363683.7An issue was discovered in OpenSSH before 8.9. If a client is using public-key authentication with agent forwarding but without -oLogLevel=v CVE-2021-363697.5An issue was discovered in Dropbear through 2020.81. Due to a non-RFC-compliant check of the available authentication methods in the client-CVE-2021-36377.5A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessi CVE-2021-363707.5An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither CVE-2021-363713.7Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cer CVE-2021-363729.8In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with a CVE-2021-363735.5When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an ou