Description
Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/rancher | >= 1.5.0, < 1.5.3 | 1.5.3 | GHSA-w3x4-9854-95x8 |
| Go | github.com/rancher/rancher | >= 1.4.0, < 1.4.3 | 1.4.3 | GHSA-w3x4-9854-95x8 |
| Go | github.com/rancher/rancher | >= 1.3.0, < 1.3.5 | 1.3.5 | GHSA-w3x4-9854-95x8 |
| Go | github.com/rancher/rancher | >= 1.2.0, < 1.2.4 | 1.2.4 | GHSA-w3x4-9854-95x8 |
| Go | github.com/rancher/rancher | >= 1.2.0, < 1.2.4 · >= 1.3.0, < 1.3.5 · >= 1.4.0, < 1.4.3 · >= 1.5.0, < 1.5.3 | 1.2.4, 1.3.5, 1.4.3, 1.5.3 | GO-2023-1973 |