106 matches found
PT-2023-23655
Name of the Vulnerable Software and Affected Versions SUSE RKE2 versions 1.24.0 through 1.24.17+rke2r1 SUSE RKE2 versions 1.25.0 through 1.25.13+rke2r1 SUSE RKE2 versions 1.26.0 through 1.26.8+rke2r1 SUSE RKE2 versions 1.27.0 through 1.27.5+rke2r1 SUSE RKE2 versions 1.28.0 through 1.28.1+rke2r1...
Code injection
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material cluster certificate authority private keys, secrets encryption configuration passphrase, etc. and decrypt it, without having to know the...
CVE-2021-32001 K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material cluster certificate authority private keys, secrets encryption configuration passphrase, etc. and decrypt it, without having to know the...
CVE-2021-32001
K3s (SUSE Rancher) and RKE2 installations are affected by CVE-2021-32001, where a user with direct datastore access or a datastore backup copy can extract cluster keying material (including CA private keys and encryption passphrases) and decrypt data without the token. Affected versions include S...
CVE-2021-32001
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material cluster certificate authority private keys, secrets encryption configuration passphrase, etc. and decrypt it, without having to know the...
CVE-2021-32001: Missing Encryption of Sensitive Data
K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material cluster certificate authority private keys, secrets encryption configuration passphrase, etc. and decrypt it, without having to know the...