VYPR
← All advisories
High severity8.2NVD Advisory· Published Apr 11, 2025· Updated Apr 15, 2026

CVE-2025-23388

CVE-2025-23388

Description

A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/rancher/rancherGo
>= 2.8.0, < 2.8.132.8.13
github.com/rancher/rancherGo
>= 2.9.0, < 2.9.72.9.7
github.com/rancher/rancherGo
>= 2.10.0, < 2.10.32.10.3

Patches

7
cecf1d1e99c7
https://github.com/rancher/ranchervia osv
ecc87e7d86e9
https://github.com/rancher/ranchervia osv
a717664d9c19
https://github.com/rancher/ranchervia osv
a263bf346671

[v2.8] Fix public authProviders endpoint (#48958)

https://github.com/rancher/rancherPeter MatseykanetsFeb 3, 2025via ghsa
commit
2 files changed · +1 −16
  • pkg/auth/providers/publicapi/store.go+0 −16 modified
    @@ -1,14 +1,11 @@
 package publicapi
 
 import (
-	"strings"
-
 	"github.com/rancher/norman/httperror"
 	"github.com/rancher/norman/objectclient"
 	"github.com/rancher/norman/store/empty"
 	"github.com/rancher/norman/types"
 	"github.com/rancher/rancher/pkg/auth/providers"
-	"github.com/rancher/rancher/pkg/auth/settings"
 	"github.com/rancher/rancher/pkg/auth/util"
 	v3 "github.com/rancher/rancher/pkg/generated/norman/management.cattle.io/v3"
 	"github.com/rancher/rancher/pkg/namespace"
@@ -68,19 +65,6 @@ func (s *authProvidersStore) List(apiContext *types.APIContext, schema *types.Sc
 	return result, nil
 }
 
-func (s *authProvidersStore) Update(apiContext *types.APIContext, schema *types.Schema, data map[string]interface{}, id string) (map[string]interface{}, error) {
-	result, err := s.Update(apiContext, schema, data, id)
-	if err != nil {
-		return nil, err
-	}
-	if strings.EqualFold(settings.FirstLogin.Get(), "true") {
-		if err := settings.FirstLogin.Set("false"); err != nil {
-			return nil, err
-		}
-	}
-	return result, nil
-}
-
 func setAuthTokensStore(schema *types.Schema, apiContext *config.ScaledContext) {
 	schema.Store = &authTokensStore{
 		tokens: apiContext.Management.SamlTokens(""),
  • pkg/schemas/management.cattle.io/v3public/public_schema.go+1 −0 modified
    @@ -32,6 +32,7 @@ func authProvidersTypes(schemas *types.Schemas) *types.Schemas {
 		}).
 		MustImportAndCustomize(&PublicVersion, v3.AuthProvider{}, func(schema *types.Schema) {
 			schema.CollectionMethods = []string{http.MethodGet}
+			schema.ResourceMethods = []string{http.MethodGet}
 		}).
 		// Local provider
 		MustImportAndCustomize(&PublicVersion, v3.LocalProvider{}, func(schema *types.Schema) {
5c7aded42509

[v2.9] Fix public authProviders endpoint (#48957)

https://github.com/rancher/rancherPeter MatseykanetsFeb 3, 2025via ghsa
commit
2 files changed · +1 −16
  • pkg/auth/providers/publicapi/store.go+0 −16 modified
    @@ -1,14 +1,11 @@
 package publicapi
 
 import (
-	"strings"
-
 	"github.com/rancher/norman/httperror"
 	"github.com/rancher/norman/objectclient"
 	"github.com/rancher/norman/store/empty"
 	"github.com/rancher/norman/types"
 	"github.com/rancher/rancher/pkg/auth/providers"
-	"github.com/rancher/rancher/pkg/auth/settings"
 	"github.com/rancher/rancher/pkg/auth/util"
 	v3 "github.com/rancher/rancher/pkg/generated/norman/management.cattle.io/v3"
 	"github.com/rancher/rancher/pkg/namespace"
@@ -68,19 +65,6 @@ func (s *authProvidersStore) List(apiContext *types.APIContext, schema *types.Sc
 	return result, nil
 }
 
-func (s *authProvidersStore) Update(apiContext *types.APIContext, schema *types.Schema, data map[string]interface{}, id string) (map[string]interface{}, error) {
-	result, err := s.Update(apiContext, schema, data, id)
-	if err != nil {
-		return nil, err
-	}
-	if strings.EqualFold(settings.FirstLogin.Get(), "true") {
-		if err := settings.FirstLogin.Set("false"); err != nil {
-			return nil, err
-		}
-	}
-	return result, nil
-}
-
 func setAuthTokensStore(schema *types.Schema, apiContext *config.ScaledContext) {
 	schema.Store = &authTokensStore{
 		tokens: apiContext.Management.SamlTokens(""),
  • pkg/schemas/management.cattle.io/v3public/public_schema.go+1 −0 modified
    @@ -32,6 +32,7 @@ func authProvidersTypes(schemas *types.Schemas) *types.Schemas {
 		}).
 		MustImportAndCustomize(&PublicVersion, v3.AuthProvider{}, func(schema *types.Schema) {
 			schema.CollectionMethods = []string{http.MethodGet}
+			schema.ResourceMethods = []string{http.MethodGet}
 		}).
 		// Local provider
 		MustImportAndCustomize(&PublicVersion, v3.LocalProvider{}, func(schema *types.Schema) {
92d55b799ac1

[v2.10] Fix public authProviders endpoint (#48954)

https://github.com/rancher/rancherPeter MatseykanetsFeb 3, 2025via ghsa
commit
2 files changed · +1 −16
  • pkg/auth/providers/publicapi/store.go+0 −16 modified
    @@ -1,14 +1,11 @@
 package publicapi
 
 import (
-	"strings"
-
 	"github.com/rancher/norman/httperror"
 	"github.com/rancher/norman/objectclient"
 	"github.com/rancher/norman/store/empty"
 	"github.com/rancher/norman/types"
 	"github.com/rancher/rancher/pkg/auth/providers"
-	"github.com/rancher/rancher/pkg/auth/settings"
 	"github.com/rancher/rancher/pkg/auth/util"
 	v3 "github.com/rancher/rancher/pkg/generated/norman/management.cattle.io/v3"
 	"github.com/rancher/rancher/pkg/namespace"
@@ -68,19 +65,6 @@ func (s *authProvidersStore) List(apiContext *types.APIContext, schema *types.Sc
 	return result, nil
 }
 
-func (s *authProvidersStore) Update(apiContext *types.APIContext, schema *types.Schema, data map[string]interface{}, id string) (map[string]interface{}, error) {
-	result, err := s.Update(apiContext, schema, data, id)
-	if err != nil {
-		return nil, err
-	}
-	if strings.EqualFold(settings.FirstLogin.Get(), "true") {
-		if err := settings.FirstLogin.Set("false"); err != nil {
-			return nil, err
-		}
-	}
-	return result, nil
-}
-
 func setAuthTokensStore(schema *types.Schema, apiContext *config.ScaledContext) {
 	schema.Store = &authTokensStore{
 		tokens: apiContext.Management.SamlTokens(""),
  • pkg/schemas/management.cattle.io/v3public/public_schema.go+1 −0 modified
    @@ -32,6 +32,7 @@ func authProvidersTypes(schemas *types.Schemas) *types.Schemas {
 		}).
 		MustImportAndCustomize(&PublicVersion, v3.AuthProvider{}, func(schema *types.Schema) {
 			schema.CollectionMethods = []string{http.MethodGet}
+			schema.ResourceMethods = []string{http.MethodGet}
 		}).
 		// Local provider
 		MustImportAndCustomize(&PublicVersion, v3.LocalProvider{}, func(schema *types.Schema) {
de3ffa88cc75

Fix public authProviders endpoint (#48608)

https://github.com/rancher/rancherPeter MatseykanetsJan 7, 2025via ghsa
commit
2 files changed · +1 −16
  • pkg/auth/providers/publicapi/store.go+0 −16 modified
    @@ -1,14 +1,11 @@
 package publicapi
 
 import (
-	"strings"
-
 	"github.com/rancher/norman/httperror"
 	"github.com/rancher/norman/objectclient"
 	"github.com/rancher/norman/store/empty"
 	"github.com/rancher/norman/types"
 	"github.com/rancher/rancher/pkg/auth/providers"
-	"github.com/rancher/rancher/pkg/auth/settings"
 	"github.com/rancher/rancher/pkg/auth/util"
 	v3 "github.com/rancher/rancher/pkg/generated/norman/management.cattle.io/v3"
 	"github.com/rancher/rancher/pkg/namespace"
@@ -68,19 +65,6 @@ func (s *authProvidersStore) List(apiContext *types.APIContext, schema *types.Sc
 	return result, nil
 }
 
-func (s *authProvidersStore) Update(apiContext *types.APIContext, schema *types.Schema, data map[string]interface{}, id string) (map[string]interface{}, error) {
-	result, err := s.Update(apiContext, schema, data, id)
-	if err != nil {
-		return nil, err
-	}
-	if strings.EqualFold(settings.FirstLogin.Get(), "true") {
-		if err := settings.FirstLogin.Set("false"); err != nil {
-			return nil, err
-		}
-	}
-	return result, nil
-}
-
 func setAuthTokensStore(schema *types.Schema, apiContext *config.ScaledContext) {
 	schema.Store = &authTokensStore{
 		tokens: apiContext.Management.SamlTokens(""),
  • pkg/schemas/management.cattle.io/v3public/public_schema.go+1 −0 modified
    @@ -32,6 +32,7 @@ func authProvidersTypes(schemas *types.Schemas) *types.Schemas {
 		}).
 		MustImportAndCustomize(&PublicVersion, v3.AuthProvider{}, func(schema *types.Schema) {
 			schema.CollectionMethods = []string{http.MethodGet}
+			schema.ResourceMethods = []string{http.MethodGet}
 		}).
 		// Local provider
 		MustImportAndCustomize(&PublicVersion, v3.LocalProvider{}, func(schema *types.Schema) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.