{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-32001", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "datePublished": "2021-07-19T00:00:00", "dateUpdated": "2022-11-09T00:00:00", "dateReserved": "2021-05-03T00:00:00"}, "containers": {"cna": {"title": "K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token", "datePublic": "2021-07-19T00:00:00", "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2022-11-09T00:00:00"}, "descriptions": [{"lang": "en", "value": "K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions."}], "affected": [{"vendor": "SUSE", "product": "Rancher", "versions": [{"version": "K3s", "status": "affected", "lessThanOrEqual": "v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1", "versionType": "custom"}]}, {"vendor": "SUSE", "product": "Rancher", "versions": [{"version": "RKE2", "status": "affected", "lessThanOrEqual": "v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1188453"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-311: Missing Encryption of Sensitive Data", "cweId": "CWE-311"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1188453", "defect": ["1188453"], "discovery": "INTERNAL"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_k3s:1.19.12:*:*:*:*:*:*:*", "matchCriteriaId": "9F01F797-DFE0-4B12-96BF-C92EED0CD7B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_k3s:1.20.8:*:*:*:*:*:*:*", "matchCriteriaId": "438C56A6-DC6C-430D-91C9-7A392CB15935", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_k3s:1.21.2:*:*:*:*:*:*:*", "matchCriteriaId": "E087A392-429D-4157-927D-D5A12C301F59", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:1.19.12:*:*:*:*:*:*:*", "matchCriteriaId": "116A6CD7-3027-44F6-80A8-1CBD95547DA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:1.20.8:*:*:*:*:*:*:*", "matchCriteriaId": "03D93121-9542-43C3-AAA3-82B406C329E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:suse:rancher_rke2:1.21.2:*:*:*:*:*:*:*", "matchCriteriaId": "F878C56D-62E2-4132-9F06-FB22365995E3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions."}, {"lang": "es", "value": "K3s en SUSE Rancher permite a cualquier usuario con acceso directo al almac\u00e9n de datos, o a una copia de seguridad del almac\u00e9n de datos, extraer el material de clave confidencial del cl\u00faster (claves privadas de la autoridad de certificaci\u00f3n del cl\u00faster, frase de contrase\u00f1a de configuraci\u00f3n de cifrado de secretos, etc.) y descifrarlo, sin tener que conocer el valor del token. Este problema afecta a: SUSE Rancher K3s versi\u00f3n v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 y versiones anteriores; RKE2 versi\u00f3n v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 y versiones anteriores"}], "id": "CVE-2021-32001", "lastModified": "2022-11-14T19:30:38.950", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "meissner@suse.de", "type": "Secondary"}]}, "published": "2021-07-28T10:15:08.327", "references": [{"source": "meissner@suse.de", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1188453"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-311"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{}