CVE-2021-32001
Published: Jul 28, 2021
Modified: Sep 16, 2024
CVSS v3.1
6.5
Description
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.
| Vendor | Product | Versions |
|---|---|---|
SUSE | Rancher | affected K3s - <= v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 |
SUSE | Rancher | affected RKE2 - <= v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now