Executive brief
Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2
Affected products
- Go github.com/fluxcd/flux2
- Go github.com/fluxcd/kustomize-controller
Junglewise Threat Intelligence
CVE-2022-24877: GO-2022-0447 - Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2
CVE-2022-24877 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: github.com/fluxcd/flux2 (Go), github.com/fluxcd/kustomize-controller (Go). Vendors: Go.
Related threats
- GO-2022-0960 - Flux CLI Workload Injection in github.com/fluxcd/flux2
- GO-2022-0448 - Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
- GO-2022-0260 - Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
- GO-2022-1071 - Denial of service in flux controllers in github.com/fluxcd modules
- Helm Controller denial of service