Skip to content
OpenAdvisories
High WID-SEC-2024-3273 3 CVEs

Rancher: Mehrere Schwachstellen

Published Oct 24, 2024 · Updated Oct 24, 2024 · de-DE

Vendor: rancher Product: rancher

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Informationen offenzulegen, erhöhte Rechte zu erlangen und beliebigen Code auszuführen.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 3

  • Critical 9.1
    CVE-2022-45157

    Exposure of vSphere's CPI and CSI credentials in Rancher

    A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and C…

    SUSE Rancher github.com/rancher/rancher Go
  • Critical 9.1
    CVE-2024-22036

    Rancher Remote Code Execution via Cluster/Node Drivers

    A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living …

    SUSE Rancher github.com/rancher/rancher Go
  • Medium 6.6
    CVE-2023-32197

    Rancher's External RoleTemplates can lead to privilege escalation

    A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5.

    SUSE Rancher

Revision history

  1. #1

    Initiale Fassung

References