crates.io/coreos-installer CVE-2021-20319: high 7.8, EPSS 0.52%

coreos-installer improperly verifies GPG signature when decompressing gzipped artifact

Action: Upgrade coreos-installer to 0.10.1 or later.

cargo update -p coreos-installer --precise 0.10.1

Affected

Fixed versions

Sources

• osv: GHSA-3r3g-g73x-g593
• https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593
• https://nvd.nist.gov/vuln/detail/CVE-2021-20319
• https://github.com/coreos/coreos-installer/pull/655
• https://github.com/coreos/coreos-installer/pull/659/commits/ad243c6f0eff2835b2da56ca5f7f33af76253c89
• https://bugzilla.redhat.com/show_bug.cgi?id=2011862
• https://github.com/coreos/coreos-installer
• https://rustsec.org/advisories/RUSTSEC-2022-0103.html

CVE-2021-20319 · published 2021-10-12T16:06:47Z · modified 2026-09-10T03:49:08.951357435Z · JSON