March 07, 2019
This advisory was first communicated by email, on the date mentioned above, to all Rancher customers with a then active support subscription.
Dear Rancher User,
This is a follow-up to our email that was sent last week, on March 1st. It was regarding CVE-2019-1002100, an issue discovered in kube-apiserver that was communicated as addressed by this Kubernetes Security Announcement: Kubernetes Security Announcement - v1.11.8, 1.12.6, 1.13.4 released to address medium severity CVE-2019-1002100
Kubernetes versions that address CVE-2019-1002100 are:
As communicated in our heads-up email, we have made available this week new Rancher releases that will enable you to move to one of the above Kubernetes versions. The new Rancher releases are:
- Rancher 2.1.7: release comes with the latest Kubernetes versions - i.e. v1.11.8, v1.12.6, v1.13.4 - for clusters launched by Rancher. To address Kubernetes CVE-2019-1002100, we recommend upgrading your Kubernetes clusters to one of these versions. Note:
- Kubernetes 1.12.6 was promoted from experimental to officially supported.
- New Kubernetes version v1.13.4 is now officially supported.
- Rancher 2.0.12: release enables Kubernetes v1.11.8 support for clusters launched by Rancher. To address Kubernetes CVE-2019-1002100, we recommend upgrading your Kubernetes clusters to this version.
If you are a Rancher 1.6.x user, please read the following:
- Kubernetes v1.11.8 and v1.12.6 support has been added to Rancher catalog and made available to Rancher v1.6.26 users. If you run Rancher v1.6.26, the new versions will become available on the next catalog auto refresh.
If there are any questions, simply submit a request via this portal referencing this article and we will track and respond to your question as a Support Ticket.
Rancher Support Team