CRITICAL🇵🇱 Wersja polska

CVE-2022-24877

CVSS 9.9v3.1pub. 2022-05-06upd. 2024-11-21

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Fluxcd Flux2

    APP
    Fluxcd
    < 0.29.0

  • Fluxcd Kustomize Controller

    APP
    Fluxcd
    < 0.24.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalLPEContainer
CWE
References

Related vulnerabilities

CVE-2022-24817CRITICAL9.9ten sam produkt

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and ...

CVE-2022-36049HIGH7.7ten sam produkt

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-control...

CVE-2022-36035HIGH7.7ten sam produkt

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), ...

CVE-2022-24878HIGH7.7ten sam produkt

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-co...

CVE-2021-41254HIGH8.8ten sam produkt

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infras...