CVE-2022-24878CWE-22

Improper path handling in Kustomization files allows for denial of service

High · published May 6, 2022

CVSS v3.1
7.7
EPSS
1%
Percentile
63.0
In the wild
Unconfirmed
What it is

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01018 · 63.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-05-06T01:35Z
EPSS history
Timeline
  • 06 MAY 01:35Z
    Improper path handling in Kustomization files allows for denial of service
    cvelistv5