SUSE Rancher Fleet vulnerabilities

Missing validation of 'valuesFrom' references in Helm Deployer of SUSE Rancher Fleet allows owners of one tenant to access fleet credentials of other tenants. Affected versions: 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15.

A vulnerability in SUSE Rancher Fleet allows forgery of unauthenticated webhook requests, which can be exploited by a remote attacker to cause a denial of service (DoS) or a downgrade attack on other repositories in the system. The issue affects versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.5.

In SUSE Rancher Fleet versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15, missing filtering in the bundle reader when the helmRepoURLRegex field is not set on a GitRepo resource causes Helm authentication credentials (BasicAuth) to be forwarded to any URL specified in the helm.repo field of a fleet.yaml file. This allows attackers with push access to Fleet-monitored git repositories to leak Helm access credentials.