GHSA-53pj-67m4-9w98

Rancher code injection via fluentd config commands

Source: GitHub Advisory Database (reviewed) High CVE-2019-12303

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/rancher/rancher	>= 2.0.0, < 2.2.4	2.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-12303 advisory
https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466 web
https://github.com/rancher/rancher package