CVE-2022-24877
Critical
Description
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
SeverityCritical
CVSS9.9
Exploit probability—
ProductFluxcd Flux2
PublishedMay 6, 2022
First seenMay 6, 2022
Weakness typeCWE-22Path traversalCWE-36CWE-36
How to fix
Update
- fluxcd flux20.29.0 or later
- fluxcd kustomize-controller0.24.0 or later
- github.com/fluxcd/kustomize-controller0.24.0 or later
- github.com/fluxcd/flux20.29.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fluxcd flux2 | v < 0.29.0 | 0.29.0 |
| fluxcd kustomize-controller | v < 0.24.0 | 0.24.0 |
| github.com/fluxcd/kustomize-controllerGo | v < 0.24.0 | 0.24.0 |
| github.com/fluxcd/flux2Go | v < 0.29.0 | 0.29.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.