Vulnerability · Published Nov 13, 2024 · Assigned by suse
CVE-2022-45157Exposure of vSphere's CPI and CSI credentials in Rancher
Critical 9.1
In plain English
A critical-severity security flaw in rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.9.3 | GHSA-xj7w-r753-vj8v |
| Go | github.com/rancher/rancher | 2.8.9 | GHSA-xj7w-r753-vj8v |
| Go | github.com/rancher/rancher | no fix listed | GO-2024-3223 |
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L