Description
A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive *
permissions for core namespaces. This can lead to someone being capable
of accessing, creating, updating, or deleting a namespace in the
project.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | rancher | 2.6.0 – < 2.6.14, 2.7.0 – < 2.7.10, 2.8.0 – < 2.8.2 | 2.6.14 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/rancher | >= 2.6.0, < 2.6.14 | 2.6.14 | GHSA-c85r-fwc7-45vc |
| Go | github.com/rancher/rancher | >= 2.7.0, < 2.7.10 | 2.7.10 | GHSA-c85r-fwc7-45vc |
| Go | github.com/rancher/rancher | >= 2.8.0, < 2.8.2 | 2.8.2 | GHSA-c85r-fwc7-45vc |
| Go | github.com/rancher/rancher | all versions | — | GO-2024-2535 |
Advisories 1
- WID-SEC-2024-0332 Rancher: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 8, 2024