Description
A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resourceNames scoping. The operator only requires access to the pull-secret Secret. If the samples-operator pod or its service account token is compromised through a separate vulnerability, an attacker could read all secrets in openshift-config, potentially including OAuth identity provider credentials, cloud provider credentials, and other sensitive cluster configuration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat OpenShift Container Platform 4.20
Default version status: affected
1792826398 to < *unaffected
Red Hat Red Hat OpenShift Container Platform 4.21
Default version status: affected
1792852494 to < *unaffected
Red Hat Red Hat OpenShift Container Platform 4.22
Default version status: affected
1792770602 to < *unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 5
Default version status: affected