CVE-2022-39272

MEDIUM

Published Oct 22, 20223y ago · Modified Jun 17, 20262w ago

4.3 CVSS 3.1

Medium

Published Oct 22, 2022 3y ago

Last Modified Jun 17, 2026 2w ago

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

CVSS Details

Base Score

4.3

Exploitability

2.8

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability Low

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-1284

Affected Products 35

Vendor	Product	Version	Range
fluxcd	flux2	*	≥0.1.0 – <0.35.0
fluxcd	helm-controller	*	≥0.0.2 – <0.24.0
fluxcd	helm-controller	0.0.1	any
fluxcd	helm-controller	0.0.1	any
fluxcd	helm-controller	0.0.1	any
fluxcd	helm-controller	0.0.1	any
fluxcd	helm-controller	0.0.1	any
fluxcd	helm-controller	0.0.1	any
fluxcd	image-automation-controller	*	≥0.1.0 – <0.26.0
fluxcd	image-reflector-controller	*	≥0.1.0 – <0.22.0
fluxcd	kustomize-controller	*	≥0.0.2 – <0.29.0
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	kustomize-controller	0.0.1	any
fluxcd	notification-controller	*	≥0.0.2 – <0.27.0
fluxcd	notification-controller	0.0.1	any
fluxcd	notification-controller	0.0.1	any
fluxcd	notification-controller	0.0.1	any
fluxcd	source-controller	*	≥0.0.2 – <0.30.0
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any
fluxcd	source-controller	0.0.1	any

References 2

github.com https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v

Third Party Advisory
github.com https://github.com/kubernetes/apimachinery/issues/131

Issue TrackingPatchThird Party Advisory

Remediation

github.com https://github.com/kubernetes/apimachinery/issues/131

Issue TrackingPatchThird Party Advisory