Vulnerability · Published Jun 6, 2022 · Assigned by Tigera

CVE-2022-28224Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature

Medium 5.5

In plain English

A medium-severity information exposure in Calico from Project Calico. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.6%top 50.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/projectcalico/calico	3.22.2	GHSA-9394-xfq9-6qrp
Go	github.com/projectcalico/calico	3.21.5	GHSA-9394-xfq9-6qrp
Go	github.com/projectcalico/calico	3.20.5	GHSA-9394-xfq9-6qrp

Affected products (as reported)

Vendor	Product	Versions
Tigera	Calico Enterprise	unspecified – through v3.12.0
Project Calico	Calico	unspecified – through v3.22.1

Weakness: CWE-200, CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

References

https://www.tigera.io/security-bulletins-tta-2022-001/ x_refsource_MISC