Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2022-45157

Exposure of vSphere's CPI and CSI credentials in Rancher

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.9.0 to < 2.9.3affected
  • 2.7.0 to < 2.8.9affected

References