CVE-2021-25318
Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources
Impact
A vulnerability was discovered in Rancher versions 2.0 through the aforementioned fixed versions, where users were granted access to resources regardless of the resource's API group. For example Rancher should have allowed users access to `apps.catalog.cattle.io`, but instead incorrectly gave access to `apps.*`. Resource affected include: **Downstream clusters:** apiservices clusters clusterrepos persistentvolumes storageclasses **Rancher management cluster** apprevisions apps catalogtemplates catalogtemplateversions clusteralertgroups clusteralertrules clustercatalogs clusterloggings clustermonitorgraphs clusterregistrationtokens clusterroletemplatebindings clusterscans etcdbackups nodepools nodes notifiers pipelineexecutions pipelines pipelinesettings podsecuritypolicytemplateprojectbindings projectalertgroups projectalertrules projectcatalogs projectloggings projectmonitorgraphs projectroletemplatebindings projects secrets sourcecodeproviderconfigs There is not a direct mitigation besides upgrading to the patched Rancher versions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/rancher/rancher | >= 2.0.0, < 2.4.16 | 2.4.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rancher | Rancher | before 2.4.16 from 2.5.0 before 2.5.9 |