PT-2024-10044 · Rancher+1 · Rancher+1

Guilherme Macedo · Published 2024-10-25 · Updated 2024-11-13 · CVE-2022-45157

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.8.9 Rancher versions prior to 2.9.3 Rancher versions 2.7.0 through 2.7.x

Description A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. The exposed passwords were accessible in the following objects: provisioning.cattle.io in spec.rkeConfig.chartValues.rancher-vsphere-cpi and spec.rkeConfig.chartValues.rancher-vsphere-csi, and rke.cattle.io.rkecontrolplane in spec.chartValues.rancher-vsphere-cpi and spec.chartValues.rancher-vsphere-csi. The vulnerability is only applicable to users that deploy clusters in vSphere environments.

Recommendations For Rancher versions prior to 2.8.9, update to version 2.8.9 or later and execute the script provided in the support tools to mitigate any vulnerable leftover vSphere clusters' credentials. For Rancher versions prior to 2.9.3, update to version 2.9.3 or later and execute the script provided in the support tools to mitigate any vulnerable leftover vSphere clusters' credentials. For Rancher versions 2.7.0 through 2.7.x, update to one of the patched versions by following the standard update procedure based on the 2.7 version that is being used. Enable the provisioningprebootstrap feature flag after updating to one of the patched versions. As a temporary workaround, consider restricting access to Rancher to trusted users and not allowing direct access to untrusted users to the clusters' infrastructure.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2025-00182

CVE-2022-45157

GHSA-XJ7W-R753-VJ8V

GO-2024-3223

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Rancher

Suse

References · 75

• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00182 · Security Note
• https://osv.dev/vulnerability/GHSA-xj7w-r753-vj8v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45157 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3223 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/rancher/rancher/security/advisories/GHSA-xj7w-r753-vj8v · Note
• https://github.com/rancher/rancher · Note
• https://suse.com/security/cve/CVE-2024-9180 · Note
• https://suse.com/security/cve/CVE-2024-47003 · Note
• https://suse.com/support/update/announcement/2024/suse-su-20243911-1 · Note
• https://suse.com/security/cve/CVE-2024-8996 · Note
• https://suse.com/security/cve/CVE-2024-9313 · Note