Log in Start free

Vulnerability · Published Sep 7, 2022 · Assigned by GitHub_M

CVE-2022-36049Flux2 Helm Controller denial of service

High 7.7

In plain English

A high-severity uncontrolled resource consumption in flux2 from fluxcd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop processing reconciliations. In a shared cluster multi-tenancy environment, a tenant could create a HelmRelease that makes the controller panic, denying all other tenants from their Helm releases being reconciled. Patches are available in flux2 v0.32.0 and helm-controller v0.23.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/fluxcd/flux20.32.0GHSA-p2g7-xwvr-rrw3
Gogithub.com/fluxcd/helm-controller0.23.0GHSA-p2g7-xwvr-rrw3

Affected products (as reported)

VendorProductVersions
fluxcd flux2 >= 0.0.4, < 0.23.0>= 0.0.17, < 0.32.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

References