DescriptionK3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
|National Vulnerability Database|
|National Vulnerability Database||SUSE|
|Attack Vector||Network||Adjacent Network|
SUSE Security Advisories:
- GHSA-cxm9-4m6p-24mc, published Tue Aug 3 15:41:30 CEST 2021
- GHSA-hvj9-vfxp-c3cf, published Fri Jul 23 16:55:25 CEST 2021
SUSE Timeline for this CVECVE page created: Mon Jul 19 13:59:51 2021
CVE page last modified: Wed Nov 9 16:47:15 2022