CVE-2024-22032

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-22032
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22032.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22032
Aliases
Related
Published
2024-10-16T13:26:01.883Z
Modified
2026-08-12T03:51:16.642336901Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
Details

A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster members, and Project members (for projects within the cluster), all have RBAC permissions to view the cluster object from the apiserver.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "suse",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22032.json"
}
References

Affected packages

Git / github.com/rancher/rancher

Affected ranges

Type
GIT
Repo
https://github.com/rancher/rancher
Events
Introduced
ce9a7aea4b13fed7acd02cc32667b2ae72f98f5a
Fixed
ae8fa4989d171c6081cd5addb9d058fb0f57eedd
Introduced
72f58378bf03122a9651c9bd3b4c143a57e8fdaa
Fixed
7af1354e9b8900cec6e5360787e291acd376e6d3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.14"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "2.8.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.7.0
v2.7.0-novkdm
v2.7.12
v2.7.12-alpha1
v2.7.12-alpha2
v2.7.12-rc1
v2.7.12-rc2
v2.7.12-rc3
v2.7.13
v2.7.13-alpha1
v2.7.13-rc1
v2.7.13-rc2
v2.7.13-rc3
v2.7.13-rc4
v2.7.13-rc5
v2.7.14-rc1
v2.7.14-rc2
v2.7.2
v2.7.2-rc1
v2.7.2-rc10
v2.7.2-rc2
v2.7.2-rc3
v2.7.2-rc4
v2.7.2-rc5
v2.7.2-rc6
v2.7.2-rc7
v2.7.2-rc8
v2.7.2-rc9
v2.7.5
v2.7.5-rc1
v2.7.5-rc2
v2.7.5-rc3
v2.7.5-rc4
v2.7.5-rc5
v2.7.5-rc6
v2.7.7
v2.7.7-rc1
v2.7.7-rc2
v2.7.7-rc3
v2.7.7-rc4
v2.7.7-rc5
v2.7.7-rc6
v2.7.7-rc7
v2.7.8
v2.7.8-rc1
v2.8.0
v2.8.0-rc5
v2.8.3
v2.8.3-alpha1
v2.8.3-alpha2
v2.8.3-rc1
v2.8.3-rc2
v2.8.3-rc3
v2.8.3-rc4
v2.8.3-rc5
v2.8.3-rc6
v2.8.3-rc7
v2.8.3-rc8
v2.8.4
v2.8.4-alpha1
v2.8.4-rc1
v2.8.4-rc2
v2.8.4-rc3
v2.8.4-rc4
v2.8.4-rc5
v2.8.5-rc1
v2.8.5-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22032.json"