Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-64jq-m7rq-768h #2929

Closed
GoVulnBot opened this issue Jun 17, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/rancher/rancher: GHSA-64jq-m7rq-768h #2929

GoVulnBot opened this issue Jun 17, 2024 · 2 comments
Assignees
@tatianab
Labels
triaged

Comments

@GoVulnBot
Copy link

Advisory GHSA-64jq-m7rq-768h references a vulnerability in the following Go modules:

Module
github.com/rancher/rancher

Description:

Impact A vulnerability has been identified whereby privilege escalation

checks are not properly enforced for RoleTemplateobjects when external=true,
which in specific scenarios can lead to privilege escalation.

The bug in the webhook rule resolver ignores rules from a ClusterRole for
external RoleTemplates when its context is set to either project or is left
empty. The fix introduces a new field to the RoleTemplate CRD named
ExternalRules. The new field will be used to resolve rules directly from the
RoleTemplate. Additionally, rules from the backing ClusterRole will be us...

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/rancher/rancher
      non_go_versions:
        - introduced: 2.7.0
          fixed: 2.7.14
        - introduced: 2.8.0
          fixed: 2.8.5
      vulnerable_at: 1.6.30
      packages:
        - package: github.com/rancher/rancher
summary: Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher
cves:
    - CVE-2023-32196
ghsas:
    - GHSA-64jq-m7rq-768h
references:
    - advisory: https://github.com/advisories/GHSA-64jq-m7rq-768h
    - advisory: https://github.com/rancher/rancher/security/advisories/GHSA-64jq-m7rq-768h
source:
    id: GHSA-64jq-m7rq-768h
    created: 2024-06-17T23:01:14.282523669Z
review_status: UNREVIEWED
@tatianab tatianab self-assigned this Jun 25, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/595636 mentions this issue: data/reports: add 15 unreviewed reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot