CVE-2023-5056: Skupper-operator: privelege escalation via config map
First published: Mon Sep 18 2023(Updated: )
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Red Hat Service Interconnect | =1.0 | |
| Red Hat Enterprise Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-5056?
CVE-2023-5056 has been categorized with a significant severity due to its potential impact on the confidentiality of deployments.
How do I fix CVE-2023-5056?
To fix CVE-2023-5056, review and adjust the service account configurations in the Skupper operator to limit unauthorized access.
Who is affected by CVE-2023-5056?
CVE-2023-5056 affects users of Red Hat Service Interconnect 1.0 on Red Hat Enterprise Linux 9.0.
What kind of information can be accessed due to CVE-2023-5056?
Due to CVE-2023-5056, an authenticated attacker can view all deployments across namespaces in the cluster.
Is there a workaround for CVE-2023-5056?
Currently, there are no official workarounds for CVE-2023-5056, and it is recommended to apply the fix as soon as available.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-5056
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/event
- agent/description
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat service interconnect
- version/red hat service interconnect/1.0
- canonical/red hat enterprise linux
- version/red hat enterprise linux/9.0