Rancher Manager CVE-2024-58259 Unauthenticated DoS via Request Body Size

Critical Vulnerability Information Vulnerability Title Unauthenticated Denial of Service Publisher and Date samjustus published GHSA-4h45-jpvh-6p5j 5 days ago Affected and Fixed Versions Affected Versions: - >=2.12.0, =2.11.0, =2.10.0, =2.9.0, <2.9.12 Fixed Versions: - 2.12.1 - 2.11.5 - 2.10.9 - 2.9.12 Severity CVSS v3 base metrics: - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None 着 - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2024-58259 Description and Impact Description: Rancher Manager does not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints, allowing malicious users to exploit this vulnerability by sending oversized payloads. Impact: - Denial of Service (DoS): When memory consumption exceeds available resources, the server process may crash or become unresponsive. - Unauthenticated and authenticated exploitation: Although the issue was initially observed on unauthenticated endpoints, the absence of request body size limits also affects several authenticated APIs. Remediation Fix: Resolved by adding a default 1MB limit and configuration. Fixed Versions: v2.12.1, v2.11.5, v2.10.9, v2.9.12 Mitigation If upgrading to a fixed version is not possible, ensure manual enforcement of request body size limits. For example, use the nginx-ingress controller and allow only requests through ingress. References Contact the SUSE Rancher Security Team for security-related inquiries. Open an issue in the Rancher repository. Verify our support matrix and product support lifecycle.

Goal Reached Thanks to every supporter — we hit 100%!

Rancher Manager CVE-2024-58259 Unauthenticated DoS via Request Body Size

More from this source