CVE-2021-32001CWE-311

K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token

Medium · published July 28, 2021

CVSS v3.1
6.5
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration passphrase, etc.) and decrypt it, without having to know the token value. This issue affects: SUSE Rancher K3s version v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1 and prior versions; RKE2 version v1.19.12+rke2r1, v1.20.8+rke2r1, v1.21.2+rke2r1 and prior versions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00304 · 21.9th percentile
Weakness
CWE-311 · Missing Encryption of Sensitive Data
Published
2021-07-28T09:25Z
EPSS history
Timeline
  • 28 JUL 09:25Z
    K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token
    cvelistv5