CVE-2022-1706

lowPriorität · verfolgen · 26OT-Risiko · erhöhtEPSS 0.013 · 70. PerzentilDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.30% (70th) EPSS
CVSS 3.5 · low
Is it mine?
36 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenignition-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-0:2.14.0-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debuginfo-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debuginfo-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debuginfo-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debuginfo-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debugsource-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debugsource-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debugsource-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-debugsource-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-validate-debuginfo-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-validate-debuginfo-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-validate-debuginfo-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Behobenignition-validate-debuginfo-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2022:8126
  • Workaroundignition-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-0:2.14.0-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debuginfo-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debuginfo-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debuginfo-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debuginfo-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debugsource-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debugsource-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debugsource-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-debugsource-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-validate-debuginfo-0:2.14.0-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-validate-debuginfo-0:2.14.0-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-validate-debuginfo-0:2.14.0-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

  • Workaroundignition-validate-debuginfo-0:2.14.0-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)redhat_csaf

    Possible Workaround: It is not recommended to put secrets in the Ignition config.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–high · 3.5–7.5

v2.03.5lowAV:N/AC:M/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 6.8 · Auswirkung 2.9
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 3.6
v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV
v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:Lsecondary · Red Hat Product Security US
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-863USprimärCWE-200USCWE-200USCWE-863USCWE-863USCWE-863USCWE-921US
04

betroffene Produkte (36)

Betroffene Produkte und Versionsbereiche.

20 von 36 angezeigt
05

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2022:8126Red Hat Security Advisory: ignition security, bug fix, and enhancement update2022-11-15csaf · redhat_csafUS

    An update for ignition is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2022-2052Mehrere Red Hat Enterprise Linux Pakete: Mehrere SchwachstellenDeutsch2022-11-15csaf · cert_bundDE

    Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.

  • GHSA-hj57-j5cw-2mwpIgnition config accessible to unprivileged software on VMware2022-05-25ghsa · osvUS

    ### Impact Unprivileged software in VMware VMs, including software running in unprivileged containers, can retrieve an Ignition config stored in a hypervisor guestinfo variable or OVF environment. If the Ignition config contains secrets, this can result in the compromise of sensitive information. ### Patches Ignition 2.14.0 and later [adds](https://github.com/coreos/ignition/pull/1350) a new systemd service, `ignition-delete-config.service`, that deletes the Ignition config from supported hypervisors (currently VMware and VirtualBox) during the first boot. This ensures that unprivileged software cannot retrieve the Ignition config from the hypervisor. If you have external tooling that requires the Ignition config to remain accessible in VM metadata after provisioning, and your Ignition config does not include sensitive information, you can prevent Ignition 2.14.0 and later from deleting the config by masking `ignition-delete-config.service`. For example: ```json { "ignition": { "version": "3.0.0" }, "systemd": { "units": [ { "name": "ignition-delete-config.service", "mask": true } ] } } ``` ### Workarounds [Avoid storing secrets](https://coreos.github.io/ignition/operator-notes/#secrets) in Ignition configs. In addition to VMware, many cloud platforms allow unprivileged software in a VM to retrieve the Ignition config from a networked cloud metadata service. While platform-specific mitigation is possible, such as firewall rules that prevent access to the metadata service, it's best to store secrets in a dedicated platform such as [Hashicorp Vault](https://www.vaultproject.io/). ### Advice to Linux distributions Linux distributions that ship Ignition should ensure the new `ignition-delete-config.service` is installed and enabled by default. In addition, we recommend shipping a service similar to `ignition-delete-config.service` that runs when existing machines are upgraded, similar to the one in https://github.com/coreos/fedora-coreos-config/pull/1738. Consider giving your users advance notice of this change, and providing instructions for masking `ignition-delete-config.service` on existing nodes if users have tooling that requires the Ignition config to remain accessible in VM metadata. ### References For more information, see #1300 and #1350. ### For more information If you have any questions or comments about this advisory, [open an issue in Ignition](https://github.com/coreos/ignition/issues/new/choose) or email the CoreOS [development mailing list](https://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.org/).

  • GO-2022-0451Ignition config accessible to unprivileged software on VMware in github.com/coreos/ignition2024-08-21vendor · osvUS

    Ignition config accessible to unprivileged software on VMware in github.com/coreos/ignition

06

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdredhat_csafNVDCVE.orgMITRE
veröffentlicht 2022-05-17geändert 2026-06-17
09

Referenzen (34)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan