Skupper-operator: privelege escalation via config map
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Service Interconnect 1 for RHEL 9
Vendor
Red Hat
Product
Service Interconnect 1 for RHEL 9
Platforms
Unknown
Default status
affected
Package
service-interconnect/skupper-config-sync-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Service Interconnect 1 for RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.4.3-5
unaffected
rpm
*
Unavailable
None listed
Service Interconnect 1 for RHEL 9
Vendor
Red Hat
Product
Service Interconnect 1 for RHEL 9
Platforms
Unknown
Default status
affected
Package
service-interconnect/skupper-flow-collector-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Service Interconnect 1 for RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.4.3-5
unaffected
rpm
*
Unavailable
None listed
Service Interconnect 1 for RHEL 9
Vendor
Red Hat
Product
Service Interconnect 1 for RHEL 9
Platforms
Unknown
Default status
affected
Package
service-interconnect/skupper-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
Service Interconnect 1 for RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1.4.3-6
unaffected
rpm
*
Unavailable
None listed
Service Interconnect 1 for RHEL 9
Vendor
Red Hat
Product
Service Interconnect 1 for RHEL 9
Platforms
Unknown
Default status
affected
Package
service-interconnect/skupper-router-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Service Interconnect 1 for RHEL 9 · Scoped product and version facts