CVE-2022-22975

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-22975
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22975.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-22975
Aliases
Published
2022-05-11T15:13:50Z
Modified
2026-08-27T03:56:00Z
Summary
[none]
Details

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership.

Database specific 
{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22975.json"
}
References

Affected packages

Git / github.com/vmware/pinniped

Affected ranges

Type
GIT
Repo
https://github.com/vmware/pinniped
Events
Introduced
46825b1c9fac7eb6762224d64035851ee068aab0
Fixed
b458cd43b96813c848d42ad196dfc8b576c0488a
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:vmware:pinniped:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.9.0"
        },
        {
            "fixed": "0.17.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.9.0
v0.9.1
v0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22975.json"