PT-2019-18075 · Rancher · Rancher

Publicado 2019-04-10 · Atualizado 2024-06-05 · CVE-2019-6287

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rancher versions 2.0.0 through 2.1.5

Description The issue allows project members to continue accessing and managing namespaces within a project even after they have been removed from it. This means they can still create, update, read, and delete namespaces.

Recommendations For Rancher versions 2.0.0 through 2.1.5, consider restricting access to namespace management features for removed project members as a temporary workaround until a patch is available.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2019-6287

GHSA-6R7X-4Q7G-H83J

GO-2024-2764

Produtos afetados

Rancher

Referências · 12

• https://github.com/rancher/rancher · Nota
• https://github.com/rancher/rancher/issues/17724 · Nota
• https://github.com/rancher/rancher/issues/17244 · Nota
• https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11 · Aviso do Fabricante
• https://forums.rancher.com/c/announcements · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6287 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2024-2764 · Aviso do Fabricante
• https://forums.rancher.com/t/rancher-release-v2-1-6/13148 · Nota
• https://github.com/advisories/GHSA-6r7x-4q7g-h83j · Nota
• https://osv.dev/vulnerability/GHSA-6r7x-4q7g-h83j · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6287 · Nota de Segurança
• https://forums.rancher.com/t/rancher-security-announcement-cve-2018-20321-and-cve-2019-6287/13149 · Nota