CVE-2022-39272: Denial of Service Vulnerability in Flux
Summary
CVE-2022-39272: Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration. Affects kustomize versions >= 0.0.2, < 0.29.0. Fixed in 0.29.0. How to fix ↓
Also tracked for
- flux · Bitnami
- github.com/fluxcd/helm-controller/api · Go
- github.com/fluxcd/helm-controller/api · Go
- github.com/fluxcd/flux2 · Go
The same CVE-2022-39272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flux is an open and extensible continuous delivery solution for Kubernetes. It allows users to automate the deployment and management of applications on Kubernetes clusters. The vulnerability described in this report affects versions prior to 0.35.0 of Flux. Flux allows users with permissions to change its objects to provide invalid data to certain fields, causing the entire object type to stop being processed. This vulnerability can be exploited by malicious actors to disrupt the continuous delivery process and potentially impact the availability of applications running on Kubernetes clusters.
Vulnerability Detail
The vulnerability in Flux arises from a lack of input validation in the .spec.interval and .spec.timeout fields (and their structured variations). By providing invalid data to these fields, an attacker can cause the affected object type to stop being processed, leading to a denial of service condition. This vulnerability can be exploited by users with permissions to modify Flux's objects, either through a Flux source or directly within a cluster. The issue has been patched in version 0.35.0 of Flux.
How To Fix
Minimum fixed version
0.29.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, admission controllers can be employed to restrict the values that can be used for the .spec.interval and .spec.timeout fields. By configuring admission controllers, administrators can enforce validation rules to prevent the use of invalid data. However, it is still recommended to upgrade to the latest version of Flux as the primary mitigation measure.
Conclusion
The vulnerability in Flux prior to version 0.35.0 allows users with permissions to modify Flux's objects to cause a denial of service condition. Upgrading to the latest version of Flux is the recommended mitigation. Additionally, admission controllers can be used as a workaround to enforce validation rules. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kustomize →
FAQ
Flux is an open and extensible continuous delivery solution for Kubernetes. It automates the deployment and management of applications on Kubernetes clusters.
Versions of Flux prior to 0.35.0 are affected by this vulnerability.
Users with permissions to modify Flux's objects, either through a Flux source or directly within a cluster, can exploit this vulnerability.
Exploiting this vulnerability can lead to a denial of service condition, potentially impacting the availability of applications running on Kubernetes clusters.
The recommended mitigation is to upgrade Flux to version 0.35.0 or later. Additionally, admission controllers can be used as a workaround to restrict the values that can be used for the affected fields.
References
Related vulnerabilities
Recent vulnerabilities recorded for kustomize.
