SB2024082711 - Permissions, Privileges, and Access Controls in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024082711

SB2024082711 - Permissions, Privileges, and Access Controls in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 

Published: August 27, 2024

Security Bulletin ID SB2024082711
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-3177)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to improper access restrictions. A remote user can launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated.

Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.


Remediation

Install update from vendor's website.

References