CVE-2022-24877: falha crítica em fluxcd flux2
Improper path handling in kustomization files allows path traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.9epss 1.2%
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
fluxcd · flux2CVEs relacionadas — fluxcd flux2
No mesmo produto, das mais perigosas para as menos.
CVE-2022-36049HIGHFlux2 Helm Controller denial of serviceEPSS 1.5%CVE-2022-24817CRITICALImproper kubeconfig validation allows arbitrary code executionEPSS 1.1%CVE-2022-24878HIGHImproper path handling in Kustomization files allows for denial of serviceEPSS 1.0%CVE-2022-39272MEDIUMFlux2 vulnerable to Denial of Service due to Improper use of metav1.DurationEPSS 0.8%CVE-2022-36035HIGHFlux CLI Workload InjectionEPSS 0.3%