CVE-2024-5042
Assigner: redhat
Published: 2024-05-17T13:12:00.551Z
State: PUBLISHED
title: Submariner-operator: rbac permissions can allow for the spread of node compromises
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
version: 3.1
format: CVSS
descriptions: value: A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
affected: vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhacm2-tech-preview/lighthouse-agent-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:acm:2
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhacm2-tech-preview/lighthouse-coredns-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:acm:2
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhacm2-tech-preview/submariner-gateway-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:acm:2
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhacm2-tech-preview/submariner-globalnet-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:acm:2
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhacm2-tech-preview/submariner-rhel8-operator
defaultStatus: affected
cpes: cpe:/a:redhat:acm:2
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rhacm2-tech-preview/submariner-route-agent-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:acm:2
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: odf4/odf-multicluster-rhel8-operator
defaultStatus: unknown
cpes: cpe:/a:redhat:openshift_data_foundation:4
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: odf/odf-multicluster-rhel8-operator
defaultStatus: unknown
cpes: cpe:/a:redhat:openshift_data_foundation:4
datePublic: 2024-05-16T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-250
description: Execution with Unnecessary Privileges
type: CWE
x_redhatCweChain: CWE-250: Execution with Unnecessary Privileges
workarounds: value: null
timeline: time: 2024-05-15T00:00:00+00:00
value: Reported to Red Hat.
time: 2024-05-16T00:00:00+00:00
value: Made public.