PT-2019-12743 · Rancher · Rancher

Publicado 2019-06-06 · Atualizado 2024-06-05 · CVE-2019-12303

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2 through 2.2.3

Description The issue allows project owners to inject additional fluentd configuration, enabling them to read files or execute arbitrary commands inside the fluentd container. This is related to code injection via fluentd config commands.

Recommendations For versions 2 through 2.2.3, consider restricting access to the fluentd configuration to prevent code injection attacks until a patch is available.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2019-12303

GHSA-53PJ-67M4-9W98

GO-2024-2762

Produtos afetados

Rancher

Referências · 8

• https://github.com/rancher/rancher · Nota
• https://osv.dev/vulnerability/GHSA-53pj-67m4-9w98 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12303 · Nota de Segurança
• https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466 · Aviso do Fabricante
• https://github.com/advisories/GHSA-53pj-67m4-9w98 · Nota
• https://osv.dev/vulnerability/CVE-2019-12303 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2024-2762 · Aviso do Fabricante
• https://forums.rancher.com/c/announcements · Aviso do Fabricante