PT-2019-12743 · Rancher · Rancher

Published 2019-06-06 · Updated 2024-06-05 · CVE-2019-12303

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2 through 2.2.3

Description The issue allows project owners to inject additional fluentd configuration, enabling them to read files or execute arbitrary commands inside the fluentd container. This is related to code injection via fluentd config commands.

Recommendations For versions 2 through 2.2.3, consider restricting access to the fluentd configuration to prevent code injection attacks until a patch is available.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-12303

GHSA-53PJ-67M4-9W98

GO-2024-2762

Affected Products

Rancher

References · 8

• https://osv.dev/vulnerability/GHSA-53pj-67m4-9w98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12303 · Security Note
• https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12303 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2762 · Vendor Advisory
• https://forums.rancher.com/c/announcements · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/advisories/GHSA-53pj-67m4-9w98 · Note