CVE-2021-31999
Fixed in a distro release EPSS 1%CVSS 8.8
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.
Products: Rancher, Rancher SUSE Linux Enterprise Server 15
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rancher/rancher | 2.4.16 |
| Go | github.com/rancher/rancher | 2.5.9 |
| Go | github.com/rancher/rancher | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | harvester | 0 |
| Chainguard | harvester-fips | 0 |
| Chainguard | harvester-fips-webhook | 0 |
| Chainguard | harvester-webhook | 0 |