CVE-2022-24878

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24878
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24878.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24878
Aliases
Published
2022-05-06T01:35:08Z
Modified
2026-07-15T01:49:14.312865351Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator
Summary
Improper path handling in Kustomization files allows for denial of service
Details

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to validate kustomization.yaml files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0. Users are recommended to upgrade.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24878.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "flux2 < v0.28.5, >= v0.19.0"
                },
                {
                    "last_affected": "flux2 < v0.28.5, >= v0.19.0"
                },
                {
                    "introduced": "kustomize < v0.29.0, >= v0.16.0"
                },
                {
                    "last_affected": "kustomize < v0.29.0, >= v0.16.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/fluxcd/flux2

Affected ranges

Type
GIT
Repo
https://github.com/fluxcd/flux2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5346c1cca31261453f1100b3516a77750e46bb17
Fixed
adf5a5278f164834a29453f47d5281d2616c07e5
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.29.0"
        },
        {
            "fixed": "0.24.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": [
        "cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:*"
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.1-alpha.1
v0.0.1-beta.1
v0.0.1-beta.2
v0.0.1-beta.3
v0.0.1-beta.4
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.2
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.0.27
v0.0.28
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.10.0
v0.11.0
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.14.0
v0.14.1
v0.14.2
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.16.0
v0.16.1
v0.16.2
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.19.0
v0.19.1
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.20.0
v0.20.1
v0.21.0
v0.21.1
v0.22.0
v0.22.1
v0.23.0
v0.24.0
v0.24.1
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.26.0
v0.26.1
v0.26.2
v0.26.3
v0.27.0
v0.27.1
v0.27.2
v0.28.0
v0.28.1
v0.28.2
v0.28.3
v0.28.4
v0.28.5
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24878.json"

Git / github.com/fluxcd/kustomize-controller

Affected ranges

Type
GIT
Repo
https://github.com/fluxcd/kustomize-controller
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
69a9e9d6bf4666eb02d2367210b29d0a66262580
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.24.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:*"
}

Affected versions

api/v0.*
api/v0.0.10
api/v0.0.11
api/v0.0.12
api/v0.0.13
api/v0.0.8
api/v0.0.9
api/v0.1.0
api/v0.1.1
api/v0.1.2
api/v0.10.0
api/v0.11.0
api/v0.11.1
api/v0.12.0
api/v0.12.1
api/v0.12.2
api/v0.13.0
api/v0.13.1
api/v0.13.2
api/v0.13.3
api/v0.14.0
api/v0.14.1
api/v0.15.0
api/v0.15.1
api/v0.15.2
api/v0.15.3
api/v0.15.4
api/v0.15.5
api/v0.16.0
api/v0.17.0
api/v0.18.0
api/v0.18.1
api/v0.18.2
api/v0.19.0
api/v0.19.1
api/v0.2.0
api/v0.2.1
api/v0.2.2
api/v0.20.0
api/v0.20.1
api/v0.20.2
api/v0.21.0
api/v0.21.1
api/v0.22.0
api/v0.22.1
api/v0.22.2
api/v0.22.3
api/v0.23.0
api/v0.24.0
api/v0.3.0
api/v0.4.0
api/v0.5.0
api/v0.5.1
api/v0.5.2
api/v0.5.3
api/v0.6.0
api/v0.6.1
api/v0.6.2
api/v0.6.3
api/v0.7.0
api/v0.7.1
api/v0.7.2
api/v0.7.3
api/v0.7.4
api/v0.8.0
api/v0.8.1
api/v0.9.0
api/v0.9.1
api/v0.9.2
api/v0.9.3
v0.*
v0.0.1
v0.0.1-alpha.1
v0.0.1-alpha.2
v0.0.1-alpha.3
v0.0.1-alpha.4
v0.0.1-alpha.5
v0.0.1-alpha.6
v0.0.1-alpha.7
v0.0.1-alpha.8
v0.0.1-alpha.9
v0.0.1-beta.1
v0.0.1-beta.2
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.12.2
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.14.0
v0.14.1
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.18.2
v0.19.0
v0.19.1
v0.2.0
v0.2.1
v0.2.2
v0.20.0
v0.20.1
v0.20.2
v0.21.0
v0.21.1
v0.22.0
v0.22.1
v0.22.2
v0.22.3
v0.23.0
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.6.1
v0.6.2
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.9.0
v0.9.1
v0.9.2
v0.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24878.json"