Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/rancher/rke

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9GoPublished

    rke's credentials are stored in the RKE1 Cluster state ConfigMap

    CVE-2023-32191 · GHSA-6gr4-52w6-vmqx

    Affected
    • Go github.com/rancher/rke >= 1.4.18, < 1.4.19; >= 1.5.9, < 1.5.10
    Fixed in
    1.4.191.5.10· Vendor fix available
    Issue
    Impact When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data: - RancherKubernetesEngineConfig - RKENodeConfig - SSH username - SSH private key - SSH private key path - RKEConfigServices - ETCDService - External client key - BackupConfig - S3BackupConfig - AWS access key - AWS secret key - KubeAPIService - SecretsEncryptionConfig - K8s encryption configuration (contains encryption keys) - PrivateRegistries - User - Password - ECRCredentialPlugin - AWS access key - AWS secret key - AWS session token - CloudProvider - AzureCloudProvider - AAD client ID - AAD client secret - AAD client cert password - OpenstackCloudProvider - Username - User ID - Password - VsphereCloudProvider - GlobalVsphereOpts - User - Password - VirtualCenterConfig - User - Password -…

    Recommended action: Upgrade to 1.5.10 or 1.4.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →