Suse Rancher RKE2 vulnerabilities

2 CVEs affecting Suse Rancher RKE2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-32186, published 2023-09-19.

More from Suse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-32186, published 2023-09-19. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue…
• CVE-2021-32001, published 2021-07-28. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private…