PT-2022-4712 · Suse · Suse Rancher

Rmweir · Published 2022-09-07 · Updated 2026-03-03 · CVE-2021-36783

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.6.4 Rancher versions prior to 2.5.13

Description A vulnerability in SUSE Rancher allows authenticated users, including Cluster Owners, Cluster Members, Project Owners, and Project Members, to read credentials, passwords, and API tokens stored in cleartext and exposed via API endpoints. This issue is related to the storage of passwords in an unencrypted form, which can be exploited by a remote attacker to gain access to account credentials, passwords, and API tokens.

Recommendations For SUSE Rancher versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue. For Rancher versions prior to 2.5.13, update to version 2.5.13 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints that expose sensitive information until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-312

CWE-200

CWE-256

CWE-522

Related Identifiers

BDU:2022-05603

CVE-2021-36783

GHSA-8W87-58W6-HFV8

Affected Products

Suse Rancher

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-36783 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=1193990 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36783 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8w87-58w6-hfv8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05603 · Security Note
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8 · Note
• https://t.me/cvenotify/37648 · Telegram Post
• https://t.me/cvenotify/42288 · Telegram Post