CVE-2022-39272: Denial of Service in Flux Controllers in github.com/fluxcd modules
Summary
CVE-2022-39272: Denial of service in flux controllers in github.com/fluxcd modules. Affects github.com/fluxcd/helm-controller/api versions < 0.26.0. Fixed in 0.26.0. How to fix ↓
Also tracked for
- flux · Bitnami
- kustomize · Bitnami
- github.com/fluxcd/flux2 · Go
The same CVE-2022-39272 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/fluxcd is a collection of modules that provide various functionalities for managing and automating deployments in Kubernetes clusters. One of these modules is the Flux controller, which is responsible for synchronizing the desired state of Kubernetes objects with their actual state. It allows users to define and manage resources such as Helm releases, image automation, image reflectors, kustomizations, notifications, and sources. The Flux controllers are written in Go and utilize the Kubernetes API to interact with the cluster.
Vulnerability Detail
The Flux controllers in github.com/fluxcd modules are vulnerable to a denial of service attack. An attacker with permissions to modify Flux's objects can provide invalid data to certain fields, such as .spec.interval or .spec.timeout, causing the entire object type to stop being processed. This vulnerability is caused by the incompatibility between the Kubernetes type metav1.Duration and the Go type time.Duration, as well as a lack of validation within Flux to restrict allowed values. The impact of this vulnerability is that an attacker can disrupt the processing of Flux objects, potentially leading to service disruptions or resource exhaustion.
How To Fix
Minimum fixed version
0.26.0
This is the first release that contains the fix.
go get github.com/fluxcd/helm-controller/api@v0.26.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to apply the fix by updating to the fixed versions of the affected modules.
Conclusion
The Flux controllers in github.com/fluxcd modules are vulnerable to a denial of service attack. Users should update the affected modules to the fixed versions and review the input data to prevent the injection of invalid values. It is recommended to use the Vulert Playground to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/helm-controller/api →
FAQ
This vulnerability allows an attacker to disrupt the processing of Flux objects, potentially leading to service disruptions or resource exhaustion.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for open-source vulnerabilities, including this one.
The only known mitigation is to update the affected modules to the fixed versions. It is also recommended to review and validate the input data to the affected fields to prevent the injection of invalid values.
Yes, this vulnerability can be exploited remotely by an attacker with permissions to modify Flux's objects.
There is currently no evidence of active exploitation of this vulnerability.
