« Volver al listado

CVE-2022-24817

Estado: ModificadaCrítica (9.9)—

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects.

Leer descripción completaMostrar menos

Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Fluxcd — Flux2Fluxcd — Helm-controllerFluxcd — Kustomize-controller

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-24817",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-24817",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:53:22.110180Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "fluxcd",
          "product": "flux2",
          "versions": [
            {
              "status": "affected",
              "version": "flux2 < v0.29.0 >= v0.1.0"
            },
            {
              "status": "affected",
              "version": "helm-controller < v0.23.0 >= v0.1.0"
            },
            {
              "status": "affected",
              "version": "kustomize-controller < v0.19.0 >= v0.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-06T00:15:07.637",
  "references": [
    {
      "url": "https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0"
    },
    {
      "lang": "es",
      "value": "Flux2 es una solución de entrega continua abierta y extensible para Kubernetes. Las versiones de Flux2 entre 0.1.0 y 0.29.0, helm-controller versiones 0.1.0 a v0.19.0, y kustomize-controller versiones 0.1.0 a v0.23.0 son vulnerables a la inyección de código por medio de un Kubeconfig malicioso. En los despliegues multi-tenancy esto también puede conllevar una escalada de privilegios si la cuenta de servicio del controlador presenta permisos elevados. Las mitigaciones incluyen deshabilitar la funcionalidad por medio de los webhooks de Comprobación de Admisión restringiendo a los usuarios la configuración del campo \"spec.kubeConfig\" en los objetos Flux \"Kustomization\" y \"HelmRelease\". Las mitigaciones adicionales incluyen la aplicación de perfiles restrictivos de AppArmor y SELinux en el pod del controlador para limitar los binarios que pueden ejecutarse. Esta vulnerabilidad está corregida en kustomize-controller versión v0.23.0 y helm-controller versión v0.19.0, ambos incluidos en flux2 versión v0.29.0"
    }
  ],
  "lastModified": "2026-06-17T04:32:35.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B093724-43C4-4D99-A3B7-D0BC5680B9AE",
              "versionEndExcluding": "0.29.0",
              "versionStartIncluding": "0.1.0"
            },
            {
              "criteria": "cpe:2.3:a:fluxcd:helm-controller:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6A8DB05-A4C1-4E2A-93DA-610265FFC1BF",
              "versionEndExcluding": "0.19.0",
              "versionStartIncluding": "0.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E49D128E-5A7E-4B2D-85E6-B1643A7ACC04",
              "versionEndExcluding": "0.23.0",
              "versionStartIncluding": "0.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}