CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22650 – Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
https://notcve.org/view.php?id=CVE-2023-22650
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable. Se ha identificado una vulnerabilidad en la que Rancher no limpia automáticamente a un usuario que ha sido eliminado del proveedor de autenticación (AP) configurado. Esta característica también se aplica a los usuarios deshabilitados o revocados; Rancher no reflejará estas modificaciones, lo que puede dejar los tokens del usuario aún utilizables. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650 https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc • CWE-287: Improper Authentication CWE-306: Missing Authentication for Critical Function •
CVSS: 8.4EPSS: 1%CPEs: 3EXPL: 0CVE-2023-22649 – Rancher 'Audit Log' leaks sensitive information
https://notcve.org/view.php?id=CVE-2023-22649
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue. Se ha identificado una vulnerabilidad que puede provocar la filtración de datos confidenciales en los registros de auditoría de Rancher. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) es una función opcional. Solo las implementaciones que la tienen habilitada y tienen [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) configurado en "1 o superior" se ven afectadas por este problema. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22649 https://github.com/rancher/rancher/security/advisories/GHSA-xfj7-qf8w-2gcr • CWE-532: Insertion of Sensitive Information into Log File •