Corban Villa

**Name of the Vulnerable Software and Affected Versions** Rancher versions 2.14.0 through 2.14.2 Rancher versions 2.13.0 through 2.13.6 Rancher versions 2.12.0 through 2.12.10 Rancher versions 2.11.0 through 2.11.14 **Description** A SAML authentication replay issue exists in the Assertion Consumer Service (ACS) handler. The system fails to enforce the one-time use of SAML assertions, which are XML-based tokens used to communicate authentication and authorization information between an Identity Provider and a Service Provider. This missing replay protection allows an attacker who captures a valid SAML response—via man-in-the-middle attacks, compromised clients, or logs—to replay the response to authenticate without the victim's credentials. Successful exploitation can lead to unauthorized access, full cluster management takeover, and privilege escalation. **Recommendations** Upgrade Rancher versions 2.14.0 through 2.14.2 to 2.14.3. Upgrade Rancher versions 2.13.0 through 2.13.6 to 2.13.7. Upgrade Rancher versions 2.12.0 through 2.12.10 to 2.12.11. Upgrade Rancher versions 2.11.0 through 2.11.14 to 2.11.15.

**Name of the Vulnerable Software and Affected Versions** OSCAT Basic Library (affected versions not specified) **Description** The issue is an Out-of-Bounds read vulnerability that allows a local, unprivileged attacker to access limited internal data of the PLC, which may lead to a crash of the affected service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.