Patch Ticker

SUSE Rancher meta proxy allowlist bypass and credential exposure

A container management tool lets logged-in users peek into internal systems!

Summary

A flaw in the SUSE Rancher meta proxy and role handling lets a logged-in user send requests to internal systems or gain permissions they should not have. Several release lines from 2.11 to 2.15 are affected before their patched versions.

Affected when

  • An authenticated Rancher user account
  • A direct path to the Rancher server with no HTTP-aware proxy in front

What to do

Update to the patched version for your release line: 2.15.3, 2.14.7, 2.13.11, 2.12.15 or 2.11.19. If you cannot update yet, use network policies to block direct pod access to Rancher and outbound access from the Rancher server.

Update to at least the version for your product:

  • SUSE Rancher 2.15 2.15.3 or later
  • SUSE Rancher 2.14 2.14.7 or later
  • SUSE Rancher 2.13 2.13.11 or later
  • SUSE Rancher 2.12 2.12.15 or later
  • SUSE Rancher 2.11 2.11.19 or later

Products and platforms

  • SUSE Rancher

CVE IDs

Sources

Times

First published

First seen