Vulnerability · Published Apr 20, 2022 · Assigned by redhat
CVE-2022-0567
Critical 9.1
In plain English
A critical-severity improper input validation in ovn-kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)1.0%top 35.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ovn-kubernetes | OCP v 4.10.8 |
Weakness: CWE-20
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2053326 x_refsource_MISC