CVE-2022-28224

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-28224
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28224.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-28224
Aliases
Related
Published
2022-06-06T17:19:12.810Z
Modified
2026-07-15T01:48:55.656681298Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
Summary
Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
Details

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28224.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "v3.12.0"
                },
                {
                    "last_affected": "v3.22.1"
                }
            ]
        }
    ],
    "cna_assigner": "Tigera",
    "cwe_ids": [
        "CWE-200",
        "CWE-201"
    ]
}
References

Affected packages

Git / github.com/projectcalico/calico

Affected ranges

Type
GIT
Repo
https://github.com/projectcalico/calico
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0337a6efbfe8e220be55dc3c8483a1790add0724
Introduced
be5e761f5323e8d43130d22cfb76c278b202c597
Fixed
1b5d26bcb621174b233fa09d4847884d599c3c54
Introduced
a86e41d021c4c60e1f73d8dce396fe249d708cc7
Fixed
14cf6d6ea10423b12809d868eb574a9a610916f9
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.20.5"
        },
        {
            "introduced": "3.21.0"
        },
        {
            "fixed": "3.21.5"
        },
        {
            "introduced": "3.22.0"
        },
        {
            "fixed": "3.22.2"
        }
    ],
    "cpe": "cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:*"
}

Affected versions

v2.*
v2.5.0
v2.5.0-calico
v2.5.0-rc2
v2.5.0-rc2-calico
v2.6.0
v2.6.0-calico
v2.6.0-rc1
v2.6.0-rc1-calico
v2.6.0-rc2
v2.6.0-rc2-calico
v2.6.2
v2.6.2-calico
v3.*
v3.0.0
v3.0.0-alpha1-rc1
v3.0.0-alpha1-rc1-calico
v3.0.0-calico
v3.0.1
v3.0.1-calico
v3.0.12
v3.0.12-calico
v3.1.7
v3.1.7-calico
v3.10.0
v3.10.0-calico
v3.10.2
v3.10.2-calico
v3.11.1
v3.11.1-calico
v3.16.0
v3.16.0-calico
v3.16.5
v3.16.5-calico
v3.17.5
v3.17.5-calico
v3.18.1
v3.18.1-calico
v3.18.5
v3.18.5-calico
v3.2.0
v3.2.0-calico
v3.2.8
v3.2.8-calico
v3.20.1
v3.20.1-calico
v3.20.2
v3.20.2-calico
v3.20.3
v3.20.3-calico
v3.21.1
v3.21.1-calico
v3.21.2
v3.21.2-calico
v3.21.3
v3.3.7
v3.3.7-calico
v3.8.5
v3.8.5-calico
v3.9.0
v3.9.0-calico
v3.9.4
v3.9.4-calico

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28224.json"