Executive brief
Improper kubeconfig validation allows arbitrary code execution
Affected products
- Go github.com/fluxcd/helm-controller
- Go github.com/fluxcd/flux2
- Go github.com/fluxcd/kustomize-controller
Junglewise Threat Intelligence
CVE-2022-24817: Improper kubeconfig validation allows arbitrary code execution
CVE-2022-24817 · Severity: low · CVSS 3.1 · Published 2022-05-16
Technologies: github.com/fluxcd/helm-controller (Go), github.com/fluxcd/flux2 (Go), github.com/fluxcd/kustomize-controller (Go). Vendors: Go.
Related threats
- GO-2022-0960 - Flux CLI Workload Injection in github.com/fluxcd/flux2
- GO-2022-0448 - Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
- GO-2022-0447 - Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2
- GO-2022-0260 - Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
- GO-2022-1071 - Denial of service in flux controllers in github.com/fluxcd modules