Headline
GHSA-f9xf-jq4j-vqw4: Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources
A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource’s API group. For example Rancher should have allowed users access to apps.catalog.cattle.io, but instead incorrectly gave access to apps.*. Resource affected include:
Downstream clusters: apiservices clusters clusterrepos persistentvolumes storageclasses
Rancher management cluster apprevisions apps catalogtemplates catalogtemplateversions clusteralertgroups clusteralertrules clustercatalogs clusterloggings clustermonitorgraphs clusterregistrationtokens clusterroletemplatebindings clusterscans etcdbackups nodepools nodes notifiers pipelineexecutions pipelines pipelinesettings podsecuritypolicytemplateprojectbindings projectalertgroups projectalertrules projectcatalogs projectloggings projectmonitorgraphs projectroletemplatebindings projects secrets sourcecodeproviderconfigs
There is not a direct mitigation besides upgrading to the patched Rancher versions.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2021-25318
Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources
High severity GitHub Reviewed Published Jul 15, 2021 in rancher/rancher • Updated Apr 24, 2024
Package
gomod github.com/rancher/rancher (Go)
Affected versions
>= 2.0.0, < 2.4.16
>= 2.5.0, < 2.5.9
Patched versions
2.4.16
2.5.9
A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource’s API group. For example Rancher should have allowed users access to apps.catalog.cattle.io, but instead incorrectly gave access to apps.*. Resource affected include:
Downstream clusters:
apiservices
clusters
clusterrepos
persistentvolumes
storageclasses
Rancher management cluster
apprevisions
apps
catalogtemplates
catalogtemplateversions
clusteralertgroups
clusteralertrules
clustercatalogs
clusterloggings
clustermonitorgraphs
clusterregistrationtokens
clusterroletemplatebindings
clusterscans
etcdbackups
nodepools
nodes
notifiers
pipelineexecutions
pipelines
pipelinesettings
podsecuritypolicytemplateprojectbindings
projectalertgroups
projectalertrules
projectcatalogs
projectloggings
projectmonitorgraphs
projectroletemplatebindings
projects
secrets
sourcecodeproviderconfigs
There is not a direct mitigation besides upgrading to the patched Rancher versions.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-25318
- rancher/rancher#33590
- https://bugzilla.suse.com/show_bug.cgi?id=1184913
Published to the GitHub Advisory Database
Apr 24, 2024
Last updated
Apr 24, 2024