Description (CNA)
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 0.14.9; affected 0.15.0 before 0.15.5; affected 0.16.0 before 0.16.7; affected 0.17.0 before 0.17.2; affected 0.18.0-m0 before 0.18.0-rc0 |
| Red Hat / RHODF-4.16-RHEL-9 | unaffected v4.16.0-19 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774540992 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774540668 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541259 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541345 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541880 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541518 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541420 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541448 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541663 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541469 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774542075 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541617 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541614 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541633 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541625 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541625 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774542179 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541779 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541857 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541919 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774541919 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.20 | unaffected 1774542101 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
CWE
CWE-250
References
- https://access.redhat.com/errata/RHSA-2024:4591
- https://access.redhat.com/errata/RHSA-2026:6503
- https://access.redhat.com/security/cve/CVE-2024-5042
- https://bugzilla.redhat.com/show_bug.cgi?id=2280921
- https://github.com/advisories/GHSA-2rhx-qhxp-5jpw
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.