GHSA-53pj-67m4-9w98

ghsaUSosv

Rancher code injection via fluentd config commands

view advisory published 2022-05-24Licence: CC-BY-4.0

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-12303US	high8.8	1.98% (80th)	—	2019-06-06
In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.

references

External citations — patches, advisories, analysis.

https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466WEB
https://github.com/rancher/rancherPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2019-12303ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan