SUSE Rancher Stack-Based Buffer Overflow Vulnerability Allowing Denial-of-Service

A stack-based buffer overflow vulnerability has been identified in SUSE Rancher, specifically in versions 2.8.0 prior to 2.8.13, 2.9.0 prior to 2.9.7, and 2.10.0 prior to 2.10.3. This vulnerability allows for an unauthenticated denial-of-service condition, where the Rancher server crashes upon receiving certain data through the '/v3-public/authproviders' public API endpoint. Although the server crash occurs, no data is written to the API. Clusters managed by Rancher are not affected by this issue.

Impact

Exploitation of this vulnerability leads to a server crash, causing a denial-of-service condition on the Rancher server.

Remediation

Users are advised to upgrade to Rancher versions 2.8.13, 2.9.7, or 2.10.3, which include the necessary patch. Instructions for upgrading can be found in the Rancher documentation.