CVE-2024-5042

Published: May 17, 2024Modified: Jul 19, 2026Deferred

6.6

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

Exploitability: 1.3 / Impact: 4.7

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Related CWEs

Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References (9)

https://access.redhat.com/errata/RHSA-2024:4591

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:6503

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2024-5042

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2280921

Source: secalert@redhat.com

https://github.com/advisories/GHSA-2rhx-qhxp-5jpw

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:4591

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/CVE-2024-5042

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=2280921

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/advisories/GHSA-2rhx-qhxp-5jpw

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.