CVE-2024-5042: RHODF-4.16-RHEL-9 (exact versions not specified); +2 more affected products

Affected technology

Product not specified by the source · 0 to before 0.14.9, 0.15.0 to before 0.15.5, 0.16.0 to before 0.16.7, 0.17.0 to before 0.17.2, 0.18.0-m0 to before 0.18.0-rc0
Vendor not specified by the source

RHODF-4.16-RHEL-9 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.20 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2 · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

A privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster. Vendor/CNA’s CVSS 3.1 assessment (base score 6.6/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.