A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

Affected: Go: github.com/submariner-io/submariner-operator

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.

get-func-name: ReDoS in chai module opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads submariner-operator: RBAC permissions can allow for the spread of node compromises golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm golang: html/template: errors returned from MarshalJSON methods may break template escaping golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON jose: resource exhaustion jose-go: improper handling of highly compressed data node-tar: denial of service while parsing a tar file due to lack of folders depth validation nodejs-ws: denial of service when handling a request with many HTTP headers