Vulnerability Description
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fluxcd | Flux2 | < 0.29.0 |
| Fluxcd | Kustomize-Controller | < 0.24.0 |
Related Weaknesses (CWE)
References
- https://github.com/fluxcd/flux2/security/advisories/GHSA-j77r-2fxf-5jrwVendor Advisory
- https://github.com/fluxcd/flux2/security/advisories/GHSA-j77r-2fxf-5jrwVendor Advisory
FAQ
What is CVE-2022-24877?
CVE-2022-24877 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data ...
How severe is CVE-2022-24877?
CVE-2022-24877 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-24877?
Check the references section above for vendor advisories and patch information. Affected products include: Fluxcd Flux2, Fluxcd Kustomize-Controller.