CVE-2021-32001

Published: Jul 28, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.

Affected (6)

Products: Suse: Rancher K3s, Rancher Rke2

Suse

2 products

Rancher K3s

Rancher Rke2

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Suse Rancher K3s	Version 1.19.12
Suse Rancher K3s	Version 1.20.8
Suse Rancher K3s	Version 1.21.2
Suse Rancher Rke2	Version 1.19.12
Suse Rancher Rke2	Version 1.20.8
Suse Rancher Rke2	Version 1.21.2

Related CWEs

CWE-311

Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=1188453

Source: meissner@suse.de

Issue TrackingVendor Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1188453

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.