CVE-2021-32001 — Missing Encryption of Sensitive Data in Rancher

CWE-311 — Missing Encryption of Sensitive Data2 documents2 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 70.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Suse RancherSuse Rancher K3SSuse Rancher Rke2
Timeline
PublishedJul 28

Description

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDsuse/rancher_rke21.19.12, 1.20.8, 1.21.2+2
▶CVEListV5suse/rancherK3s — v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1+1
▶NVDsuse/rancher_k3s1.19.12, 1.20.8, 1.21.2+2

🔴Vulnerability Details

1
CVEList
K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token↗2021-07-28
▶
CVE-2021-32001 — Missing Encryption of Sensitive Data | cvebase