HIGH🇬🇧 English

CVE-2022-24878

CVSS 7.7v3.1pub. 2022-05-06upd. 2024-11-21

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

  • Fluxcd Flux2

    APP
    Fluxcd
    < 0.29.0

  • Fluxcd Kustomize Controller

    APP
    Fluxcd
    < 0.24.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path TraversalDoSContainer
CWE
Referencje

Powiązane podatności

CVE-2022-24817CRITICAL9.9PL ✓ten sam produkt

Code Injection przez złośliwy Kubeconfig w Flux2 / helm-controller / kustomize-controller

CVE-2022-24877CRITICAL9.9PL ✓ten sam produkt

Path Traversal w Flux kustomize-controller umożliwia ujawnienie danych i privilege escalation

CVE-2022-36049HIGH7.7ten sam produkt

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-control...

CVE-2022-36035HIGH7.7ten sam produkt

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), ...

CVE-2021-41254HIGH8.8ten sam produkt

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infras...