Vulnerability · Published Sep 1, 2022 · Assigned by redhat

CVE-2022-1677

Medium 6.3

In plain English

A medium-severity uncontrolled resource consumption in Openshift. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS NVD)6.3Medium

Exploit odds (30 days)0.6%top 51.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.

Affected products (as reported)

Vendor	Product	Versions
n/a	Openshift	Openshift 3.11 and 4.6 onwards

Weakness: CWE-400

References

https://bugzilla.redhat.com/show_bug.cgi?id=2076211 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2022-1677 x_refsource_MISC