| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| github.com/rancher/rancher | ≥ 2.0.0, < 2.4.16≥ 2.0.0+incompatible≥ 2.5.0, < 2.5.9 | 2.4.162.5.9 |
| rancher | ≥ 2.5.0, < 2.5.9< 2.4.16 | 2.5.92.4.16 |
A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to apps.catalog.cattle.io, but instead incorrectly gave access to apps.*. Resource affected include:
Downstream clusters: apiservices clusters clusterrepos persistentvolumes storageclasses
Rancher management cluster apprevisions apps catalogtemplates catalogtemplateversions clusteralertgroups clusteralertrules clustercatalogs clusterloggings clustermonitorgraphs clusterregistrationtokens clusterroletemplatebindings clusterscans etcdbackups nodepools nodes notifiers pipelineexecutions pipelines pipelinesettings podsecuritypolicytemplateprojectbindings projectalertgroups projectalertrules projectcatalogs projectloggings projectmonitorgraphs projectroletemplatebindings projects secrets sourcecodeproviderconfigs
There is not a direct mitigation besides upgrading to the patched Rancher versions.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン