Description
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | Rancher | Rancher – < 2.5.17 | 2.5.17 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/rancher | >= 2.5.0, < 2.5.17 | 2.5.17 | GHSA-g25r-gvq3-wrq7 |
| Go | github.com/rancher/rancher | >= 2.6.0, < 2.6.10 | 2.6.10 | GHSA-g25r-gvq3-wrq7 |
| Go | github.com/rancher/rancher | >= 2.7.0, < 2.7.1 | 2.7.1 | GHSA-g25r-gvq3-wrq7 |
Advisories 1
- WID-SEC-2023-0197 Rancher: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 24, 2023