4.3
Moyenne
CVE-2025-2842 A flaw was found in the Tempo Operator
Description
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift distributed tracing 3.5.2 | Versions non publiées | |
| Red Hat OpenShift distributed tracing 3 | Versions non publiées | |
| Red Hat OpenShift distributed tracing 3.5.1 | Versions non publiées | |
| Red Hat OpenShift distributed tracing 3.5 | Versions non publiées | |
| Red Hat OpenShift distributed tracing 3.5.3 | Versions non publiées |
Références
- RHSA-2025:3607 access.redhat.com
- RHSA-2025:3740 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2355219 bugzilla.redhat.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat OpenShift distributed tracing 3.5.2
Les 4 CVE de Red Hat OpenShift distributed tracing 3.5.2 →
CVE-2025-7425
Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
7.8
Élevée
CVE-2025-5914
Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c
7.8
Élevée
CVE-2025-2786
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user…
4.3
Moyenne