Skip to content
Log inStart free trial

GHSA-xr9q-h9c7-xw8q CVE-2025-23388 GO-2025-3491

Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API

High Go
Severity
8.2 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.60%
Chance of exploitation in the next 30 days. Higher than 48.87% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-121 Stack-based Buffer Overflow
Fix
2.8.13
Upgrade github.com/rancher/rancher to this version or later

Description

Impact

An unauthenticated stack overflow crash, leading to a denial of service (DoS), was identified in Rancher’s /v3-public/authproviders public API endpoint. A malicious user could submit data to the API which would cause the Rancher server to crash, but no malicious or incorrect data would actually be written in the API. The downstream clusters, i.e., the clusters managed by Rancher, are not affected by this issue.

This vulnerability affects those using external authentication providers as well as Rancher’s local authentication.

Patches

The patch includes the removal of unnecessary HTTP methods of the specific API.

Patched versions include releases v2.8.13, v2.9.7 and v2.10.3.

Workarounds

There are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of Rancher Manager that contains the fix.

References

If you have any questions or comments about this advisory:

Affected versions

Go

PackageVulnerableFixed in
github.com/rancher/rancher
>= 2.8.0, < 2.8.13
2.8.13
github.com/rancher/rancher
>= 2.9.0, < 2.9.7
2.9.7
github.com/rancher/rancher
>= 2.10.0, < 2.10.3
2.10.3
github.com/rancher/rancher
all versions
 No fix yet

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/rancher/rancher Go → 2.8.13

go
go get github.com/rancher/rancher@v2.8.13 && go mod tidy

Severity breakdown

CVSS 3.1 8.2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Weakness

CWE-121: Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

How to prevent it
  • Operation, Build and Compilation: Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
  • Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Implementation: Implement and perform bounds checking on input.
  • Implementation: Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
  • Operation, Build and Compilation: Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking. For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].

References

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-4j6x-2764-m8gh
Rancher has over-inclusive team membership expansion in GitHub App authentication provider
High Also affects github.com/rancher/rancher
GHSA-vx8h-4prv-g744
Rancher has Privilege Escalation from Project Owner to Host
High Also affects github.com/rancher/rancher
GHSA-mhc6-2gfq-xx62
Rancher vulnerable to command injection through unsanitized YAML parameter
Critical Also affects github.com/rancher/rancher
GHSA-5v3h-x4wf-5c35
Rancher Extensions have arbitrary file access via path traversal
High Also affects github.com/rancher/rancher
GHSA-gqf8-rvrh-g7w6
Rancher cloud credentials can be used through proxy API by users without access
Critical Also affects github.com/rancher/rancher
GHSA-hwm2-4ph6-w6m5
Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user
High Also affects github.com/rancher/rancher
GHSA-mc24-7m59-4q5p
Rancher CLI skips TLS verification on Rancher CLI login command
Medium Also affects github.com/rancher/rancher
GHSA-mw39-9qc2-f7mg
Rancher exposes sensitive information through audit logs
Medium Also affects github.com/rancher/rancher
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor