id: GO-2024-2930
modules:
    - module: github.com/rancher/rke
      versions:
        - introduced: 1.4.18
        - fixed: 1.4.19
        - introduced: 1.5.9
        - fixed: 1.5.10
      vulnerable_at: 1.5.10-rc.1
      packages:
        - package: github.com/rancher/rke/k8s
          symbols:
            - UpdateSecret
            - GetSecretsList
            - GetSecret
            - GetSystemSecret
        - package: github.com/rancher/rke/cluster
          symbols:
            - SaveFullStateToKubernetes
            - RebuildState
            - GetK8sVersion
            - Cluster.GetStateFileFromConfigMap
            - Cluster.StoreAddonConfigMap
            - FullState.WriteStateFile
            - buildFreshState
            - ReadStateFile
            - GetStateFromKubernetes
          derived_symbols:
            - Cluster.CheckClusterPorts
            - Cluster.CleanDeadLogs
            - Cluster.CleanupNodes
            - Cluster.ClusterRemove
            - Cluster.DeployControlPlane
            - Cluster.DeployRestoreCerts
            - Cluster.DeployStateFile
            - Cluster.DeployWorkerPlane
            - Cluster.DisableSecretsEncryption
            - Cluster.PrePullK8sImages
            - Cluster.ReconcileDesiredStateEncryptionConfig
            - Cluster.RewriteSecrets
            - Cluster.RotateEncryptionKey
            - Cluster.RunSELinuxCheck
            - Cluster.SetUpHosts
            - Cluster.SyncLabelsAndTaints
            - Cluster.TunnelHosts
            - Cluster.UpdateClusterCurrentState
            - Cluster.UpgradeControlPlane
            - Cluster.UpgradeWorkerPlane
            - ConfigureCluster
            - GetClusterCertsFromKubernetes
            - RebuildKubeconfig
            - ReconcileCluster
            - ReconcileEncryptionProviderConfig
            - RestartClusterPods
        - package: github.com/rancher/rke/cmd
          symbols:
            - ClusterUp
            - getStateFile
            - saveClusterState
          derived_symbols:
            - ClusterInit
            - ClusterRemove
            - RestoreEtcdSnapshot
            - RestoreEtcdSnapshotFromCli
            - RetrieveClusterStateConfigMap
            - RotateEncryptionKey
            - SnapshotRemoveFromEtcdHosts
            - SnapshotSaveEtcdHosts
            - SnapshotSaveEtcdHostsFromCli
summary: RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke
description: |-
    When RKE provisions a cluster, it stores the cluster state in a configmap called
    "full-cluster-state" inside the "kube-system" namespace of the cluster itself.
    This cluster state object contains information used to set up the K8s cluster,
    which may include sensitive data.
cves:
    - CVE-2023-32191
ghsas:
    - GHSA-6gr4-52w6-vmqx
references:
    - advisory: https://github.com/rancher/rke/security/advisories/GHSA-6gr4-52w6-vmqx
    - fix: https://github.com/rancher/rke/commit/cf49199481a1891909acb1384eed73a5c987d5bd
    - fix: https://github.com/rancher/rke/commit/f7485b8dce376db0fc15a7c3ceb3de7029c8d0cf
source:
    id: GHSA-6gr4-52w6-vmqx
    created: 2024-07-01T13:30:12.796528-04:00
review_status: REVIEWED