Vulnerability · Published May 25, 2022 · Assigned by suse

CVE-2022-21951Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden

Medium 6.8

In plain English

A medium-severity security flaw in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/rancher/rancher	2.6.5	GHSA-vrph-m5jj-c46c
Go	github.com/rancher/rancher	2.5.14	GHSA-vrph-m5jj-c46c

Affected products (as reported)

Vendor	Product	Versions
SUSE	Rancher	Rancher – before 2.5.14
SUSE	Rancher	Rancher – before 2.6.5

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://bugzilla.suse.com/show_bug.cgi?id=1199443 x_refsource_CONFIRM
https://github.com/rancher/rancher/security/advisories/GHSA-vrph-m5jj-c46c x_refsource_CONFIRM