CVE-2023-5056: A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments...

Summary

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of th...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
redhat	service_interconnect	1.0 `cpe:2.3:a:redhat:service_interconnect:1.0:::::::*`

Original advisory text

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments...

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.

References

https://access.redhat.com/errata/RHSA-2023:6219 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-5056 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2239517 Issue Tracking