PT-2022-2955 · Unknown · Ovn Kubernetes

Sam Fowler · Published 2022-04-20 · Updated 2022-05-04 · CVE-2022-0567

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ovn-kubernetes (affected versions not specified)

Description A flaw in ovn-kubernetes allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster. This results in information disclosure and other attacks on pods that should not be reachable. The issue is related to insufficient input validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-03564

CVE-2022-0567

Affected Products

Ovn Kubernetes

References · 7

• https://osv.dev/vulnerability/CVE-2022-0567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0567 · Security Note
• https://bdu.fstec.ru/vul/2022-03564 · Security Note
• https://access.redhat.com/security/cve/CVE-2022-0567 · Note
• https://t.me/cvenotify/29212 · Telegram Post
• https://t.me/cibsecurity/41176 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2053326 · Note