Log in Start free

Vulnerability · Published May 17, 2024 · Assigned by redhat

CVE-2024-5042Submariner-operator: rbac permissions can allow for the spread of node compromises

Medium 6.6

In plain English

A medium-severity security flaw in submariner-operator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.6Medium
Exploit odds (30 days)0.5%top 56.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/submariner-io/submariner-operator0.16.4GHSA-2rhx-qhxp-5jpw
Gogithub.com/submariner-io/submariner-operator0.17.2GHSA-2rhx-qhxp-5jpw
Gogithub.com/submariner-io/submariner-operator0.15.4GHSA-2rhx-qhxp-5jpw
Gogithub.com/submariner-io/submariner-operator0.18.0-rc0GHSA-2rhx-qhxp-5jpw
Gogithub.com/submariner-io/submariner-operator0.16.4GO-2024-2866

Affected products (as reported)

VendorProductVersions
submariner-operator 0 – before 0.14.90.15.0 – before 0.15.50.16.0 – before 0.16.70.17.0 – before 0.17.20.18.0-m0 – before 0.18.0-rc0
Red Hat RHODF-4.16-RHEL-9 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Openshift Data Foundation 4.20 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 see references

Weakness: CWE-250 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

References