No. Junglewise Threat Intelligence has no report of CVE-2022-39272 being exploited in the wild.
How severe is CVE-2022-39272?
Low severity, with a CVSS score of 3.1, published 28 October 2022.
Which products and versions are affected?
github.com/fluxcd/flux2 (Go) SEMVER:introduced=0.1.0,fixed=0.35.0; github.com/fluxcd/helm-controller (Go) SEMVER:introduced=0.0.1-alpha-1,fixed=0.24.0; github.com/fluxcd/helm-controller/api (Go) SEMVER:introduced=0,fixed=0.26.0; github.com/fluxcd/image-automation-controller (Go) SEMVER:introduced=0.1.0,fixed=0.26.0; and 9 more.
Is there a fix for CVE-2022-39272?
Yes. github.com/fluxcd/flux2 (Go): upgrade to 0.35.0 or later; github.com/fluxcd/helm-controller (Go): upgrade to 0.24.0 or later; github.com/fluxcd/helm-controller/api (Go): upgrade to 0.26.0 or later; github.com/fluxcd/image-automation-controller (Go): upgrade to 0.26.0 or later; github.com/fluxcd/image-automation-controller/api (Go): upgrade to 0.26.1 or later; github.com/fluxcd/image-reflector-controller (Go): upgrade to 0.22.0 or later; github.com/fluxcd/image-reflector-controller/api (Go): upgrade to 0.22.1 or later; github.com/fluxcd/kustomize-controller (Go): upgrade to 0.29.0 or later; github.com/fluxcd/kustomize-controller/api (Go): upgrade to 0.30.0 or later; github.com/fluxcd/notification-controller (Go): upgrade to 0.27.0 or later; github.com/fluxcd/notification-controller/api (Go): upgrade to 0.28.0 or later; github.com/fluxcd/source-controller (Go): upgrade to 0.30.0 or later; github.com/fluxcd/source-controller/api (Go): upgrade to 0.30.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2022-39272?
Check whether you run github.com/fluxcd/flux2 (Go), github.com/fluxcd/helm-controller (Go), github.com/fluxcd/helm-controller/api (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
github.com/fluxcd/flux2 (Go): upgrade to 0.35.0 or later
go get github.com/fluxcd/flux2@v0.35.0
github.com/fluxcd/helm-controller (Go): upgrade to 0.24.0 or later
go get github.com/fluxcd/helm-controller@v0.24.0
github.com/fluxcd/helm-controller/api (Go): upgrade to 0.26.0 or later
go get github.com/fluxcd/helm-controller/api@v0.26.0
github.com/fluxcd/image-automation-controller (Go): upgrade to 0.26.0 or later
go get github.com/fluxcd/image-automation-controller@v0.26.0
github.com/fluxcd/image-automation-controller/api (Go): upgrade to 0.26.1 or later
go get github.com/fluxcd/image-automation-controller/api@v0.26.1
github.com/fluxcd/image-reflector-controller (Go): upgrade to 0.22.0 or later
go get github.com/fluxcd/image-reflector-controller@v0.22.0
github.com/fluxcd/image-reflector-controller/api (Go): upgrade to 0.22.1 or later
go get github.com/fluxcd/image-reflector-controller/api@v0.22.1
github.com/fluxcd/kustomize-controller (Go): upgrade to 0.29.0 or later
go get github.com/fluxcd/kustomize-controller@v0.29.0
github.com/fluxcd/kustomize-controller/api (Go): upgrade to 0.30.0 or later
go get github.com/fluxcd/kustomize-controller/api@v0.30.0
github.com/fluxcd/notification-controller (Go): upgrade to 0.27.0 or later
go get github.com/fluxcd/notification-controller@v0.27.0
github.com/fluxcd/notification-controller/api (Go): upgrade to 0.28.0 or later
go get github.com/fluxcd/notification-controller/api@v0.28.0
github.com/fluxcd/source-controller (Go): upgrade to 0.30.0 or later
go get github.com/fluxcd/source-controller@v0.30.0
github.com/fluxcd/source-controller/api (Go): upgrade to 0.30.0 or later
go get github.com/fluxcd/source-controller/api@v0.30.0