CVE-2022-36035: Flux CLI Workload Injection
First published: Wed Aug 31 2022(Updated: )
Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git repositories), and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allows other applications to replace the Flux deployment information with arbitrary content which is deployed into the target Kubernetes cluster instead. The vulnerability is due to the improper handling of user-supplied input, which results in a path traversal that can be controlled by the attacker. Users sharing the same shell between other applications and the Flux CLI commands could be affected by this vulnerability. In some scenarios no errors may be presented, which may cause end users not to realize that something is amiss. A safe workaround is to execute Flux CLI in ephemeral and isolated shell environments, which can ensure no persistent values exist from previous processes. However, upgrading to the latest version of the CLI is still the recommended mitigation strategy.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fluxcd Flux2 | >=0.21.0<0.32.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-36035?
CVE-2022-36035 is a vulnerability in Flux, a tool for keeping Kubernetes clusters in sync with sources of configuration.
What is the severity of CVE-2022-36035?
CVE-2022-36035 has a severity rating of 7.8, which is considered high.
What is the affected software for CVE-2022-36035?
The affected software for CVE-2022-36035 is Flux 2, specifically versions 0.21.0 to 0.32.0.
How can I fix CVE-2022-36035?
To fix CVE-2022-36035, you should update Flux 2 to version 0.32.0 or higher.
Where can I find more information about CVE-2022-36035?
You can find more information about CVE-2022-36035 in the advisory on the Flux 2 GitHub security advisories page.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/author
- agent/severity
- agent/first-publish-date
- agent/description
- agent/tags
- agent/event
- vendor/fluxcd
- canonical/fluxcd flux2
- version/fluxcd flux2/0.21.0