Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2024-22032

Medium
6.5/10

Summary

In Rancher, it was discoved to contain an issue, where custom secrets encryption configurations were being stored in plaintext under the clusters "AppliedSpec". This flaw leads to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. This was also causing clusters to continuously reconcile, as the "AppliedSpec" would never match the desired cluster "Spec". The information stored here contains the encryption configuration for secrets within "etcd", and could potentially expose sensitive data if the "etcd" database was exposed directly. This vulnerability affects github.com/rancher/rancher package versions 2.7.0-rc1 through 2.7.13, 2.8.0-alpha1 through 2.8.4, and 2.8.6-alpha1 through v2.9.0-alpha6 and 2.9.0-rc1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published