CVE-2022-43755

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-331

Affected software

Vendor	Product	Versions
SUSE	Rancher	>= Rancher, < 2.6.10

References

https://bugzilla.suse.com/show_bug.cgi?id=1205297Issue Tracking, Patch
https://bugzilla.suse.com/show_bug.cgi?id=1205297Issue Tracking, Patch

Timeline

Published: Feb 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-437567.5A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows re CVE-2022-437578.8A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. T CVE-2022-437586.8A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execu CVE-2022-437598.8A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permission CVE-2022-43764.3An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions s CVE-2022-437608.4An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some h CVE-2022-437617.5Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system co CVE-2022-437629.8Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages CVE-2022-437637.5Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versio CVE-2022-437649.8Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buf CVE-2022-437657.5B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network CVE-2022-437667.5Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for R