PT-2017-17643 · Rancher · Rancher Server

Will-Chan · Published 2017-03-29 · Updated 2024-08-20 · CVE-2017-7297

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher Labs rancher server versions 1.2.0 through 1.2.3 Rancher Labs rancher server versions 1.3.0 through 1.3.4 Rancher Labs rancher server versions 1.4.0 through 1.4.2 Rancher Labs rancher server versions 1.5.0 through 1.5.2

Description The issue allows authenticated users to disable access control via an API call.

Recommendations For versions 1.2.0 through 1.2.3, update to rancher/server:v1.2.4. For versions 1.3.0 through 1.3.4, update to rancher/server:v1.3.5. For versions 1.4.0 through 1.4.2, update to rancher/server:v1.4.3. For versions 1.5.0 through 1.5.2, update to rancher/server:v1.5.3.

Fix

Related Identifiers

CVE-2017-7297

GHSA-W3X4-9854-95X8

GO-2023-1973

Affected Products

Rancher Server

References · 10

• https://osv.dev/vulnerability/GO-2023-1973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7297 · Security Note
• https://osv.dev/vulnerability/GHSA-w3x4-9854-95x8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7297 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/issues/8296 · Note
• https://web.archive.org/web/20200227181556/http://securityfocus.com/bid/97180 · Note
• https://t.me/cvenotify/24096 · Telegram Post
• https://github.com/advisories/GHSA-w3x4-9854-95x8 · Note
• http://securityfocus.com/bid/97180 · Note