Rancher Fleetで権限昇格の脆弱性、修正版あり
Summary
Rancher Fleetに、一般ユーザーが管理用クラスターの管理者権限を得られる脆弱性が公表されました。複数チームでRancherを共用している組織は、Fleetの版を確認して修正版へ更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Rancher Fleetに、一般ユーザーが管理用クラスターの管理者権限を得られる脆弱性が公表されました。複数チームでRancherを共用している組織は、Fleetの版を確認して修正版へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| SUSE | Rancher |
≥ 0.16.0, < 0.16.3 ≥ 0.15.0, < 0.15.8 ≥ 0.14.0, < 0.14.12 ≥ 0.13.0, < 0.13.17 |
0.16.3 0.15.8 0.14.12 0.13.17 |
Original description The description as published by the source.
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.
Source: CVE.org (CVE Program・cvelistV5) NVD
References
- web meissner@suse.de