Suse Rancher vulnerabilities, page 5
89 vulnerabilities
Known vulnerabilities in Suse Rancher, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2023-22647Gogithub.com/rancher · rancher +1 moregithub.com/rancher rancherAn Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local
cluster, resulting in the secret being deleted, but their read-level
permissions to the secret being preserved. When this operation was
followed-up by other specially crafted commands, it could result in the
user gaining access to tokens belonging to service accounts in the local cluster.
This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.EPSS0.71%HighCVE-2023-22650chainguard · harvester +5 moreRancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderA vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.EPSS0.61%HighCVE-2023-22649chainguard · harvester +5 moreRancher 'Audit Log' leaks sensitive informationA vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.EPSS2.04%CriticalCVE-2023-22651Gogithub.com/rancher · rancher +1 moregithub.com/rancher rancherImproper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to
the misconfiguration of the Webhook. This component enforces validation
rules and security checks before resources are admitted into the
Kubernetes cluster.
The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.EPSS0.78%HighCVE-2023-22648Gogithub.com/rancher · rancher +1 moregithub.com/rancher rancherA Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users
while they are logged in the Rancher UI. This would cause the users to
retain their previous permissions in Rancher, even if they change groups
on Azure AD, for example, to a lower privileged group, or are removed
from a group, thus retaining their access to Rancher instead of losing
it.
This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.EPSS0.45%HighCVE-2023-32196chainguard · harvester +5 moreRancher's External RoleTemplates can lead to privilege escalationA vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.EPSS0.55%HighCVE-2023-32197suse · rancherRancher's External RoleTemplates can lead to privilege escalationA Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5.EPSS0.63%MediumCVE-2023-32199chainguard · harvester +5 moreRancher user retains access to clusters despite Global Role removalA vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLsEPSS0.22%HighCVE-2023-32194chainguard · harvester +5 moreRancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive *
permissions for core namespaces. This can lead to someone being capable
of accessing, creating, updating, or deleting a namespace in the
project.EPSS0.42%