CVE-2024-5042
Fixed upstream EPSS <1%CVSS 6.6
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
Products: Red Hat RHODF-4.16-RHEL-9, Red Hat Openshift Data Foundation 4.20, Red Hat Advanced Cluster Management for Kubernetes 2
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/submariner-io/submariner-operator | 0.16.4 |
| Go | github.com/submariner-io/submariner-operator | 0.17.2 |
| Go | github.com/submariner-io/submariner-operator | 0.15.4 |
| Go | github.com/submariner-io/submariner-operator | 0.18.0-rc0 |