PT-2024-4564 · Unknown · Submariner Operator

Skitt

·

Published

2024-05-17

·

Updated

2024-07-17

·

CVE-2024-5042

CVSS v3.1

6.6

Medium

VectorAV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Submariner Operator (affected versions not specified)
Description: A flaw was found in the Submariner project due to unnecessary role-based access control permissions. This allows a privileged attacker to run a malicious container on a node, potentially enabling them to steal service account tokens and further compromise other nodes and the entire cluster. The issue is related to errors in managing privileges in the Submariner Operator, which can be exploited by a remote attacker to launch an arbitrary container on a node.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2024-05068
CVE-2024-5042
GHSA-2RHX-QHXP-5JPW
GO-2024-2866

Affected Products

Submariner Operator