CVE-2022-39272

Published: Oct 22, 2022Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

Affected (35)

Products: Fluxcd: Flux2, Helm Controller, Image Automation Controller, Image Reflector Controller, Kustomize Controller, Notification Controller, Source Controller

Fluxcd

7 products

Flux2

Helm Controller

Image Automation Controller

Image Reflector Controller

Kustomize Controller

Notification Controller

Source Controller

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Fluxcd Flux2	From 0.1.0 to 0.35.0
Fluxcd Helm Controller	From 0.0.2 to 0.24.0
Fluxcd Helm Controller	Version 0.0.1 alpha1
Fluxcd Helm Controller	Version 0.0.1 alpha2
Fluxcd Helm Controller	Version 0.0.1 beta1
Fluxcd Helm Controller	Version 0.0.1 beta2
Fluxcd Helm Controller	Version 0.0.1 beta3
Fluxcd Helm Controller	Version 0.0.1 beta4
Fluxcd Image Automation Controller	From 0.1.0 to 0.26.0
Fluxcd Image Reflector Controller	From 0.1.0 to 0.22.0
Fluxcd Kustomize Controller	From 0.0.2 to 0.29.0
Fluxcd Kustomize Controller	Version 0.0.1 alpha1
Fluxcd Kustomize Controller	Version 0.0.1 alpha2
Fluxcd Kustomize Controller	Version 0.0.1 alpha3
Fluxcd Kustomize Controller	Version 0.0.1 alpha4
Fluxcd Kustomize Controller	Version 0.0.1 alpha5
Fluxcd Kustomize Controller	Version 0.0.1 alpha6
Fluxcd Kustomize Controller	Version 0.0.1 alpha7
Fluxcd Kustomize Controller	Version 0.0.1 alpha8
Fluxcd Kustomize Controller	Version 0.0.1 alpha9
Fluxcd Kustomize Controller	Version 0.0.1 beta1
Fluxcd Kustomize Controller	Version 0.0.1 beta2
Fluxcd Notification Controller	From 0.0.2 to 0.27.0
Fluxcd Notification Controller	Version 0.0.1 alpha1
Fluxcd Notification Controller	Version 0.0.1 alpha2
Fluxcd Notification Controller	Version 0.0.1 beta1
Fluxcd Source Controller	From 0.0.2 to 0.30.0
Fluxcd Source Controller	Version 0.0.1 alpha1
Fluxcd Source Controller	Version 0.0.1 alpha2
Fluxcd Source Controller	Version 0.0.1 alpha3
Fluxcd Source Controller	Version 0.0.1 alpha4
Fluxcd Source Controller	Version 0.0.1 alpha5
Fluxcd Source Controller	Version 0.0.1 alpha6
Fluxcd Source Controller	Version 0.0.1 beta1
Fluxcd Source Controller	Version 0.0.1 beta2