Vulnerability Description
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fluxcd | Flux2 | < 0.29.0 |
| Fluxcd | Kustomize-Controller | < 0.24.0 |
Related Weaknesses (CWE)
References
- https://github.com/fluxcd/flux2/security/advisories/GHSA-7pwf-jg34-hxwpThird Party Advisory
- https://github.com/fluxcd/flux2/security/advisories/GHSA-7pwf-jg34-hxwpThird Party Advisory
FAQ
What is CVE-2022-24878?
CVE-2022-24878 is a vulnerability with a CVSS score of 7.7 (HIGH). Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Serv...
How severe is CVE-2022-24878?
CVE-2022-24878 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24878?
Check the references section above for vendor advisories and patch information. Affected products include: Fluxcd Flux2, Fluxcd Kustomize-Controller.