Vulnerabilites related to suse - rancher_rke2
Vulnerability from fkie_nvd
Published
2023-09-19 10:15
Modified
2024-11-21 08:02
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service.
This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| meissner@suse.de | https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186 | Issue Tracking, Vendor Advisory | |
| meissner@suse.de | https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq | Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq | Mitigation, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| suse | rancher_rke2 | * | |
| suse | rancher_rke2 | * | |
| suse | rancher_rke2 | * | |
| suse | rancher_rke2 | * | |
| suse | rancher_rke2 | 1.28.1\+rke2r1 | |
| suse | rancher_rke2 | 1.28.1\+rke2r1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "195E8F96-931F-438D-BB2B-C2F06E15FF88",
"versionEndExcluding": "1.24.17\\+rke2r1",
"versionStartIncluding": "1.24.0\\+rke2r1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9C4538F6-9D57-42C2-A8AD-3A60092DE90A",
"versionEndExcluding": "1.25.13\\+rke2r1",
"versionStartIncluding": "1.25.0\\+rke2r1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8276EC2F-6723-41E8-87FC-4960B1B889B1",
"versionEndExcluding": "1.26.8\\+rke2r1",
"versionStartIncluding": "1.26.0\\+rke2r1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0DABB36B-6677-485A-B93A-85EC6F0F5870",
"versionEndExcluding": "1.27.5\\+rke2r1",
"versionStartIncluding": "1.27.1\\+rke2r1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:1.28.1\\+rke2r1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "509E3AE9-B776-40AD-9BC5-722A05C3718E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:1.28.1\\+rke2r1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "33ACA7A8-9A6B-4EC1-B4BC-C554533592CC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service.\nThis issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.\n\n"
},
{
"lang": "es",
"value": "Una vulnerabilidad de Asignaci\u00f3n de Recursos sin L\u00edmites o Throttling en SUSE RKE2 permite a los atacantes con acceso al puerto apiserver/supervisor de servidores K3s (TCP 6443) causar denegaci\u00f3n de servicio. Este problema afecta a RKE2: desde la versi\u00f3n 1.24.0 antes de 1.24.17+rke2r1, desde la versi\u00f3n v1.25.0 antes de v1.25.13+rke2r1, desde la versi\u00f3n v1.26.0 antes de v1.26.8+rke2r1, desde la versi\u00f3n v1.27.0 antes de v1.27.5+rke2r1, desde la versi\u00f3n v1.28.0 antes de v1.28.1+rke2r1."
}
],
"id": "CVE-2023-32186",
"lastModified": "2024-11-21T08:02:52.080",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "meissner@suse.de",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-19T10:15:13.357",
"references": [
{
"source": "meissner@suse.de",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186"
},
{
"source": "meissner@suse.de",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq"
}
],
"sourceIdentifier": "meissner@suse.de",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "meissner@suse.de",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-28 10:15
Modified
2024-11-21 06:06
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| meissner@suse.de | https://bugzilla.suse.com/show_bug.cgi?id=1188453 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.suse.com/show_bug.cgi?id=1188453 | Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| suse | rancher_k3s | 1.19.12 | |
| suse | rancher_k3s | 1.20.8 | |
| suse | rancher_k3s | 1.21.2 | |
| suse | rancher_rke2 | 1.19.12 | |
| suse | rancher_rke2 | 1.20.8 | |
| suse | rancher_rke2 | 1.21.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:rancher_k3s:1.19.12:*:*:*:*:*:*:*",
"matchCriteriaId": "9F01F797-DFE0-4B12-96BF-C92EED0CD7B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_k3s:1.20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "438C56A6-DC6C-430D-91C9-7A392CB15935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_k3s:1.21.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E087A392-429D-4157-927D-D5A12C301F59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:1.19.12:*:*:*:*:*:*:*",
"matchCriteriaId": "116A6CD7-3027-44F6-80A8-1CBD95547DA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:1.20.8:*:*:*:*:*:*:*",
"matchCriteriaId": "03D93121-9542-43C3-AAA3-82B406C329E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suse:rancher_rke2:1.21.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F878C56D-62E2-4132-9F06-FB22365995E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster\u0027s confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions."
},
{
"lang": "es",
"value": "K3s en SUSE Rancher permite a cualquier usuario con acceso directo al almac\u00e9n de datos, o a una copia de seguridad del almac\u00e9n de datos, extraer el material de clave confidencial del cl\u00faster (claves privadas de la autoridad de certificaci\u00f3n del cl\u00faster, frase de contrase\u00f1a de configuraci\u00f3n de cifrado de secretos, etc.) y descifrarlo, sin tener que conocer el valor del token. Este problema afecta a: SUSE Rancher K3s versi\u00f3n v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 y versiones anteriores; RKE2 versi\u00f3n v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 y versiones anteriores"
}
],
"id": "CVE-2021-32001",
"lastModified": "2024-11-21T06:06:41.367",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "meissner@suse.de",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-28T10:15:08.327",
"references": [
{
"source": "meissner@suse.de",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1188453"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1188453"
}
],
"sourceIdentifier": "meissner@suse.de",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-311"
}
],
"source": "meissner@suse.de",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2023-32186
Vulnerability from cvelistv5
Published
2023-09-19 09:32
Modified
2024-09-25 14:50
Severity ?
EPSS score ?
Summary
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service.
This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:10:24.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:suse:rke2:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rke2",
"vendor": "suse",
"versions": [
{
"lessThan": "1.24.17\\+/rke2r1",
"status": "affected",
"version": "1.24.0",
"versionType": "semver"
},
{
"lessThan": "1.25.13\\+/rke2r1",
"status": "affected",
"version": "1.25.0",
"versionType": "semver"
},
{
"lessThan": "1.26.8\\+/rke2r1",
"status": "affected",
"version": "1.26.0",
"versionType": "custom"
},
{
"lessThan": ".27.5\\+/rke2r1",
"status": "affected",
"version": "1.27.0",
"versionType": "semver"
},
{
"lessThan": "1.28.1\\+/rke2r1",
"status": "affected",
"version": "1.28.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32186",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-25T14:42:23.192794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-25T14:50:27.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RKE2",
"vendor": "SUSE",
"versions": [
{
"lessThan": "1.24.17+rke2r1",
"status": "affected",
"version": "1.24.0",
"versionType": "semver"
},
{
"lessThan": "v1.25.13+rke2r1",
"status": "affected",
"version": "v1.25.0",
"versionType": "semver"
},
{
"lessThan": "v1.26.8+rke2r1",
"status": "affected",
"version": "v1.26.0",
"versionType": "semver"
},
{
"lessThan": "v1.27.5+rke2r1",
"status": "affected",
"version": "v1.27.0",
"versionType": "semver"
},
{
"lessThan": "v1.28.1+rke2r1",
"status": "affected",
"version": "v1.28.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eK3s servers apiserver/supervisor port (TCP 6443) cause denial of service.\u003c/span\u003e\u003cbr\u003e\u003cp\u003eThis issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.\u003c/p\u003e"
}
],
"value": "A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service.\nThis issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-19T09:32:49.121Z",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://github.com/rancher/rke2/security/advisories/GHSA-p45j-vfv5-wprq"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32186"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2023-32186",
"datePublished": "2023-09-19T09:32:49.121Z",
"dateReserved": "2023-05-04T08:30:59.321Z",
"dateUpdated": "2024-09-25T14:50:27.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-32001
Vulnerability from cvelistv5
Published
2021-07-28 09:25
Modified
2024-09-16 22:10
Severity ?
EPSS score ?
Summary
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:10:31.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1188453"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Rancher",
"vendor": "SUSE",
"versions": [
{
"lessThanOrEqual": "v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1",
"status": "affected",
"version": "K3s",
"versionType": "custom"
}
]
},
{
"product": "Rancher",
"vendor": "SUSE",
"versions": [
{
"lessThanOrEqual": "v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1",
"status": "affected",
"version": "RKE2",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-07-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster\u0027s confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-311",
"description": "CWE-311: Missing Encryption of Sensitive Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-09T00:00:00",
"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"shortName": "suse"
},
"references": [
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1188453"
}
],
"source": {
"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1188453",
"defect": [
"1188453"
],
"discovery": "INTERNAL"
},
"title": "K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
"assignerShortName": "suse",
"cveId": "CVE-2021-32001",
"datePublished": "2021-07-28T09:25:11.153803Z",
"dateReserved": "2021-05-03T00:00:00",
"dateUpdated": "2024-09-16T22:10:22.048Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}