Executive brief
Flux CLI Workload Injection in github.com/fluxcd/flux2
Affected products
- Go github.com/fluxcd/flux2
Junglewise Threat Intelligence
CVE-2022-36035: GO-2022-0960 - Flux CLI Workload Injection in github.com/fluxcd/flux2
CVE-2022-36035 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: github.com/fluxcd/flux2 (Go). Vendors: Go.
Related threats
- GO-2022-0448 - Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
- GO-2022-0447 - Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2
- GO-2022-1071 - Denial of service in flux controllers in github.com/fluxcd modules
- Helm Controller denial of service
- Improper kubeconfig validation allows arbitrary code execution