CVE-2022-24817: fallo crítico en fluxcd flux2
Improper kubeconfig validation allows arbitrary code execution
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.9epss 1.1%
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
fluxcd · flux2CVEs relacionadas — fluxcd flux2
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-36049HIGHFlux2 Helm Controller denial of serviceEPSS 1.5%CVE-2022-24877CRITICALImproper path handling in kustomization files allows path traversalEPSS 1.2%CVE-2022-24878HIGHImproper path handling in Kustomization files allows for denial of serviceEPSS 1.0%CVE-2022-39272MEDIUMFlux2 vulnerable to Denial of Service due to Improper use of metav1.DurationEPSS 0.8%CVE-2022-36035HIGHFlux CLI Workload InjectionEPSS 0.3%