high8.8
CVE-2019-12303
Rancher code injection via fluentd config commands
Impact
In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/rancher | >= 2.0.0, <= 2.2.3 | 2.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Suse | Rancher | from 2.0.0 through 2.2.3 |