CVE-2021-32001 K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material cluster certificate authority private keys, secrets encryption configuration passphrase, etc. and decrypt it, without having to know the...

CVE-2021-32001

K3s (SUSE Rancher) and RKE2 installations are affected by CVE-2021-32001, where a user with direct datastore access or a datastore backup copy can extract cluster keying material (including CA private keys and encryption passphrases) and decrypt data without the token. Affected versions include S...

SUSE Rancher K3s 安全漏洞

SUSE Rancher K3s is a CNCF sandboxing project from SUSE Germany that provides a lightweight but powerful certified Kubernetes distribution. A security vulnerability exists in SUSE Rancher K3s that allows any user with direct access to a datastore, or a copy of a datastore backup, to extract the...

PT-2021-19621 · Suse · Rke2 +1

Name of the Vulnerable Software and Affected Versions: SUSE Rancher K3s versions v1.19.12+k3s1 through v1.21.2+k3s1 and prior versions RKE2 versions v1.19.12+rke2r1 through v1.21.2+rke2r1 and prior versions Description: A Missing Encryption of Sensitive Data issue allows any user with direct acce...

Privilege Escalation

k3s is vulnerable to privilege escalation. The vulnerability allows an attacker to obtain additional privileges within the application...

Input Validation Bypass

k3s is vulnerable to input validation bypass. Validating Admission Webhook does not observe some previous fields...