« Volver al listado

CVE-2025-2842

Estado: AplazadaMedia (4.3)—

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Jaeger — UIAITempo — OperatorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-2842",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-2842",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-02T13:12:50.601180Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.15.3",
              "versionType": "semver"
            }
          ],
          "packageName": "tempo-operator",
          "collectionURL": "https://github.com/grafana/tempo-operator",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3.5.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "rhosdt-3.5-1743162265",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhosdt/tempo-rhel8-operator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3.5.3",
          "versions": [
            {
              "status": "unaffected",
              "version": "rhosdt-3.5-1744028971",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "rhosdt/tempo-rhel8-operator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "packageName": "rhosdt/tempo-gateway-opa-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "packageName": "rhosdt/tempo-gateway-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "packageName": "rhosdt/tempo-jaeger-query-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "packageName": "rhosdt/tempo-query-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "packageName": "rhosdt/tempo-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-04-02T12:15:14.677",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:3607",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:3740",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-2842",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355219",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/grafana/tempo-operator/pull/1144",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.\nThis can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics."
    },
    {
      "lang": "es",
      "value": "Se detectó una falla en Tempo Operator. Al habilitar la pestaña Monitor de la interfaz de usuario de Jaeger en una instancia de Tempo administrada por el operador Tempo, este crea un ClusterRoleBinding para la cuenta de servicio de la instancia de Tempo para otorgar el ClusterRole de vista de monitorización de clúster. Esto puede explotarse si un usuario tiene permisos de creación en TempoStack y permisos de obtención en Secret en un espacio de nombres (por ejemplo, un usuario tiene permisos de administrador de clúster para un espacio de nombres específico), ya que el usuario puede leer el token de la cuenta de servicio de Tempo y, por lo tanto, tiene acceso para ver todas las métricas del clúster."
    }
  ],
  "lastModified": "2026-09-08T22:17:36.747",
  "sourceIdentifier": "secalert@redhat.com"
}