CVE-2019-12274: High severity suse rancher vulnerability
In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12274?
The severity of CVE-2019-12274 is high with a severity value of 8.8.
How can unprivileged users gain admin access in Rancher 1 and 2 through 2.2.3?
Unprivileged users can gain admin access in Rancher 1 and 2 through 2.2.3 if they are allowed to deploy nodes and exploit the intentional node driver options that allow posting certain data to the cloud.
What versions of Rancher are affected by CVE-2019-12274?
Versions 1.6.27 and prior of Rancher 1 and versions 2.0.0 to 2.2.3 of Rancher 2 are affected by CVE-2019-12274.
How can I fix CVE-2019-12274 in Rancher?
To fix CVE-2019-12274 in Rancher, update to version 1.6.28 or newer for Rancher 1, and update to version 2.2.4 or newer for Rancher 2.
Where can I find more information about CVE-2019-12274?
You can find more information about CVE-2019-12274 on the NVD website, the Rancher forums, and the GitHub Advisory page.