REDHAT-BUG-2512152: High severity Stolostron search-v2-operator vulnerability
addon-framework's GetValuesFromAddonAnnotation reads the addon.open-cluster-management.io/values annotation on a ManagedClusterAddOn and deep-merges arbitrary JSON into the Helm values. Because it is listed after getValue, it can override global.imageOverrides.searchcollector, org, fullnameOverride, etc. A user with patch managedclusteraddons permission in a single managed-cluster namespace can replace the collector image for that spoke without touching the hub Search CR, achieving container image injection on the managed cluster.
Upstream: stolostron/search-v2-operator
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512152?
The severity of REDHAT-BUG-2512152 is classified as high with a rating of 7.
What is the risk associated with REDHAT-BUG-2512152?
The risk rating associated with REDHAT-BUG-2512152 is 33.
How do I fix REDHAT-BUG-2512152?
To fix REDHAT-BUG-2512152, ensure that the affected annotation does not allow arbitrary JSON to be deep-merged into Helm values.
Which software is affected by REDHAT-BUG-2512152?
REDHAT-BUG-2512152 affects the Stolostron search-v2-operator.
What functionality is impacted by REDHAT-BUG-2512152?
REDHAT-BUG-2512152 impacts the GetValuesFromAddonAnnotation function, allowing unintended overrides in Helm values.