CVE-2022-39272: Improper use of metav1.Duration allows for Denial of Service in Flux
Summary
CVE-2022-39272: Improper use of metav1.Duration allows for Denial of Service. Affects github.com/fluxcd/flux2 versions >= 0.1.0, < 0.35.0. Fixed in 0.35.0. How to fix ↓
Also tracked for
- flux · Bitnami
- kustomize · Bitnami
- github.com/fluxcd/helm-controller/api · Go
- github.com/fluxcd/helm-controller/api · Go
The same CVE-2022-39272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flux is an open-source tool that provides a GitOps workflow for managing Kubernetes clusters. It automates the deployment and synchronization of container images and configuration changes to Kubernetes clusters. Flux controllers, including flux2, source-controller, kustomize-controller, helm-controller, notification-controller, image-automation-controller, and image-reflector-controller, are vulnerable to a denial of service attack. This vulnerability allows users with permissions to change Flux's objects to provide invalid data to certain fields, causing the affected object type to stop being processed. The vulnerability arises from the incompatibility between the Kubernetes type metav1.Duration and the Go type time.Duration, as well as the lack of validation within Flux to restrict allowed values.
Vulnerability Detail
The vulnerability in Flux controllers allows an attacker to disrupt the processing of certain object types by providing invalid data to fields such as .spec.interval or .spec.timeout. This can be done either through a Flux source or directly within a cluster. The issue stems from the incompatibility between the Kubernetes type metav1.Duration and the Go type time.Duration, as well as the absence of proper validation in Flux. As a result, an attacker can cause a denial of service by supplying malicious values that prevent the affected object type from being processed. This vulnerability has a CVSS score of 5.0, indicating a moderate severity.
How To Fix
Minimum fixed version
0.35.0
This is the first release that contains the fix.
go get github.com/fluxcd/flux2@v0.35.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
In addition to upgrading, an alternative workaround is to employ admission controllers to restrict the values that can be used for the vulnerable fields (spec.interval and spec.timeout). By implementing admission controllers, the system can validate and reject invalid values, thereby preventing the denial of service attack. However, upgrading to the latest versions is still the recommended approach.
Conclusion
The vulnerability in Flux controllers allows for a denial of service attack by providing invalid data to certain fields. Upgrading to the latest versions of the affected Flux controllers is the recommended mitigation. Additionally, employing admission controllers can help restrict the values for the vulnerable fields. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/flux2 →
FAQ
Flux is an open-source tool that provides a GitOps workflow for managing Kubernetes clusters. It automates the deployment and synchronization of container images and configuration changes to Kubernetes clusters.
This vulnerability allows an attacker to disrupt the processing of certain object types in Flux controllers, leading to a denial of service. It can affect the availability and functionality of the affected Flux controllers.
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of the affected Flux controllers. By updating to the fixed versions, the compatibility issue with metav1.Duration is resolved, and proper validation is implemented to restrict allowed values for the vulnerable fields.
Yes, in addition to upgrading, you can employ admission controllers to restrict the values that can be used for the vulnerable fields (spec.interval and spec.timeout). By implementing admission controllers, the system can validate and reject invalid values, thereby preventing the denial of service attack.
This vulnerability was reported by Alexander Block (@codablock) through the Flux security mailing list.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/flux2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
