Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2022-24878

Improper path handling in Kustomization files allows for denial of service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious `kustomization.yaml` allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate `kustomization.yaml` files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

fluxcd flux2

  • flux2 < v0.28.5, >= v0.19.0affected
  • kustomize < v0.29.0, >= v0.16.0affected

References