Vulnerability · Published Oct 16, 2024 · Assigned by suse
CVE-2024-22032Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
Medium 6.5
In plain English
A medium-severity information exposure in rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.7.14 | GHSA-q6c7-56cq-g2wm |
| Go | github.com/rancher/rancher | 2.8.5 | GHSA-q6c7-56cq-g2wm |
| Go | github.com/rancher/rancher | no fix listed | GO-2024-2932 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N