~ / search / GHSA-2rhx-qhxp-5jpw

GHSA-2rhx-qhxp-5jpw

Submariner Operator sets unnecessary RBAC permissions

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-5042

Packages

EcosystemPackageAffectedFixed in
Go github.com/submariner-io/submariner-operator >= 0.16.0-m0, < 0.16.4 0.16.4
Go github.com/submariner-io/submariner-operator >= 0.17.0-m0, < 0.17.2 0.17.2
Go github.com/submariner-io/submariner-operator < 0.15.4 0.15.4
Go github.com/submariner-io/submariner-operator >= 0.18.0-m0, < 0.18.0-rc0 0.18.0-rc0

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

References

External links from the advisory. They lead to third-party sites.