CVE-2022-0567: Input Validation
A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.
Other sources
When using ovn-kubernetes on a Kubernetes or OpenShift cluster, it is possible to create an egress network policy that bypasses existing an ingress policy, allowing netwrok traffic to access pods that should not be reachable. This attack is limited to pods on the same node.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0567?
CVE-2022-0567 is a critical vulnerability found in ovn-kubernetes that allows a system administrator or privileged attacker to create an egress network policy to bypass existing ingress policies, potentially granting unauthorized access to pods.
How does CVE-2022-0567 impact the affected software?
CVE-2022-0567 impacts the affected software by allowing network traffic to access pods that should not be reachable, bypassing existing ingress policies.
What is the severity of CVE-2022-0567?
CVE-2022-0567 has a severity rating of 9.1 (critical).
Which versions of ovn-kubernetes are affected by CVE-2022-0567?
Versions of ovn-kubernetes up to and including 4.8.36, 4.9.27, and 4.10.8 are affected by CVE-2022-0567.
How can the CVE-2022-0567 vulnerability be remediated?
To remediate the CVE-2022-0567 vulnerability, update ovn-kubernetes to a version higher than 4.8.36, 4.9.27, or 4.10.8.