REDHAT-BUG-2354811: Medium severity red hat openshift container platform vulnerability
The Tempo Operator in OpenShift Distributed Tracing creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This design allows any user with full access to their namespace to retrieve the associated ServiceAccount token and utilize it to make privileged API calls to:
Validate bearer tokens using the TokenReview API.
Check user permissions using the SubjectAccessReview API.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2354811?
The severity of REDHAT-BUG-2354811 is considered to be significant due to potential unauthorized access to sensitive resources.
How do I fix REDHAT-BUG-2354811?
To fix REDHAT-BUG-2354811, ensure that only authorized users have full access to their namespace and review the permissions associated with ServiceAccount, ClusterRole, and ClusterRoleBinding.
What impact does REDHAT-BUG-2354811 have on OpenShift security?
REDHAT-BUG-2354811 can lead to unauthorized users gaining access to the ServiceAccount token, potentially compromising the security of the OpenShift environment.
Which versions of OpenShift are affected by REDHAT-BUG-2354811?
REDHAT-BUG-2354811 affects Red Hat OpenShift Container Platform, but specific versions should be confirmed with Red Hat's official documentation.
Is there a workaround for REDHAT-BUG-2354811?
A possible workaround for REDHAT-BUG-2354811 is to limit namespace permissions and regularly audit ServiceAccount access to reduce exposure.