BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-3043

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: helm-push, k8sgateway, aws-node-termination-handler-fips, xeol, kube-oidc-proxy, tflint, kubernetes-dashboard-metrics-scraper-fips, kubernetes-csi-driver-nfs, amass, openfga, minio-operator, nri-mysql, influxd, pguser, spegel-fips, gosu-fips, seaweedfs, databricks-cl...

CVE-2022-24877

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: chezmoi, grafana, flux-kustomize-controller, ksops, flux-kustomize-controller-fips, litestream, grafana-fips, sops-fips, age-fips, sops, age...

GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller

Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: flux-source-controller, hugo-extended, tekton-chains, zarf, py3-azure-identity, policy-controller, bank-vaults, boring-registry, thanos, tkn, sqlpad, step-ca, tempo, rekor, kubescape, flux-kustomize-controller, prometheus-operator, flux, sigstore-scaffolding, cortex,...

BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: helm-push, metacontroller, kube-oidc-proxy, tflint, kubernetes-dashboard-metrics-scraper-fips, amass, kube-state-metrics-fips, zarf, prometheus-operator, hugo, kubernetes-csi-external-resizer, hubble-ui, kubevela, kubescape, up, syft, bank-vaults, tekton-chains,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kiam, prometheus-stackdriver-exporter, dgraph, kube-oidc-proxy, aactl, aws-efs-csi-driver-fips, prometheus-adapter-fips, vault-csi-provider, conftest-fips, metrics-server-fips, spark-operator, kubeflow-fips, terraform-provider-sendgrid-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, git-lfs, ko, fuse-overlayfs-snapshotter, grpcurl, gke-gcloud-auth-plugin, terraform, kind, weaviate, src, kots, metrics-server, secrets-store-csi-driver-provider-gcp, dgraph, buildkitd, secrets-store-csi-driver, nri-prometheus, skaffold,...

Improper path handling in Kustomization files allows for denial of service

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...

GHSA-VVMQ-FWMG-2GJC Improper kubeconfig validation allows arbitrary code execution

Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...

CVE-2022-24878

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2022-24878

CVE-2022-24878 describes a path-traversal vulnerability in Flux’s kustomize-controller. A malicious kustomization.yaml can cause the kustomize-controller to enter a denial-of-service condition at the controller level. The issue arises from improper handling of paths in Kustomization processing. T...

CVE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...