Description
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rancher | Rancher | Rancher – < 2.5.9 | 2.5.9 |
| Rancher | SUSE Linux Enterprise Server 15 | Rancher – < 2.4.16 | 2.4.16 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/rancher | >= 2.0.0, < 2.4.16 | 2.4.16 | GHSA-pvxj-25m6-7vqr |
| Go | github.com/rancher/rancher | >= 2.5.0, < 2.5.9 | 2.5.9 | GHSA-pvxj-25m6-7vqr |
| Go | github.com/rancher/rancher | >= 2.0.0+incompatible | — | GO-2024-2778 |