High severityNVD Advisory· Published Oct 16, 2024· Updated Oct 16, 2024

Rancher 'Audit Log' leaks sensitive information

CVE-2023-22649

Description

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDIT_LEVEL set to 1 or above are impacted by this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/rancher/rancherGo	>= 2.6.0, < 2.6.14	2.6.14
github.com/rancher/rancherGo	>= 2.7.0, < 2.7.10	2.7.10
github.com/rancher/rancherGo	>= 2.8.0, < 2.8.2	2.8.2

Affected products

ghsa-coords
pkg:golang/github.com/rancher/rancher
Range: >= 2.6.0, < 2.6.14
SUSE S.A./Ranchercpe-rescue
Range: 2.6.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xfj7-qf8w-2gcrghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-22649ghsaADVISORY
bugzilla.suse.com/show_bug.cgighsaWEB
github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcrghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000