CVE-2022-1798
High
Description
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.
SeverityHigh
CVSS8.7
Exploit probability—
ProductKubevirt
PublishedSep 15, 2022
First seenSep 15, 2022
Weakness typeCWE-20Improper input validation
How to fix
Update
- kubevirt kubevirt0.55.1 or later
- kubevirt.io/kubevirt0.55.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kubevirt kubevirt | 0.20.0 ≤ v < 0.55.1 | 0.55.1 |
| kubevirt.io/kubevirtGo | 0.20.0 ≤ v < 0.55.1 | 0.55.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.