PT-2022-24860 · Flux · Flux

Uasimojo · Published 2022-10-19 · Updated 2024-03-06 · CVE-2022-39272

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Flux versions prior to 0.35.0

Description The issue concerns a Denial of Service in Flux, an open and extensible continuous delivery solution for Kubernetes. Users with permissions to change Flux's objects can provide invalid data to fields spec.interval or spec.timeout, causing the entire object type to stop being processed. This is due to two root causes: the Kubernetes type metav1.Duration not being fully compatible with the Go type time.Duration, and a lack of validation within Flux to restrict allowed values.

Recommendations For versions prior to 0.35.0, upgrade to version 0.35.0 or later to resolve the issue. As a temporary workaround, consider employing Admission controllers to restrict the values that can be used for fields spec.interval and spec.timeout.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1284

CWE-20

Related Identifiers

BIT-FLUX-2022-39272

BIT-KUSTOMIZE-2022-39272

CVE-2022-39272

GHSA-F4P5-X4VC-MH4V

GO-2022-1071

Affected Products

Flux

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39272.json · Exploit
• https://github.com/kubernetes/apimachinery/issues/131 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39272 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39272 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f4p5-x4vc-mh4v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1071 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-kustomize-2022-39272 · Vendor Advisory
• https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v · Note
• https://github.com/fluxcd/flux2 · Note
• https://github.com/kubernetes/apimachinery#131 · Note
• https://github.com/fluxcd/helm-controller/pull/533 · Note
• https://github.com/fluxcd/kustomize-controller/pull/731 · Note
• https://github.com/fluxcd/source-controller/pull/903 · Note
• https://github.com/fluxcd/notification-controller/pull/420 · Note
• https://github.com/fluxcd/image-automation-controller/pull/439 · Note