by Kastro
Paper/Archive/CVE-2022-24877

CVE-2022-24877

fluxcd flux2 — Improper path handling in kustomization files allows path traversal

EPSS 1%CVSS 9.9
critical.is priorityof 100
43
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 67.9.679 × 2013.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.

Affected

ProductAffectedFixed inSource
flux2flux2 < v0.29.0–CNA
flux2kustomize-controller < v0.24.0–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/fluxcd/flux2/security/advisories/GHSA-j77r-2fxf-5jrw