IBM Licensing Operator Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the IBM Licensing Operator. The issue arises because the operator incorrectly assigns permissions to security-sensitive files, potentially allowing local root access within containers running the affected IBM Licensing Operator image. This vulnerability is linked to incorrect permission assignments for critical resources, as highlighted by the Common Weakness Enumeration (CWE) identifier CWE-732.

Impact

Exploitation of this vulnerability could lead to unauthorized local root access within containers running the affected IBM Licensing Operator image.

Remediation

Users can upgrade to IBM License Service version 4.2.18 to address this vulnerability.