Vulnerabilities

TI-2022-18648 CVE-2022-39272 · GHSA-f4p5-x4vc-mh4v

Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

LOW 24

Flux is an open and extensible continuous delivery solution for Kubernetes.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00788 Published 2022-10-21 Fixed in 0.35.0, 0.30.0 +8 CWE-1284

TI-2022-16473 CVE-2022-36049 · GHSA-p2g7-xwvr-rrw3

Flux2 Helm Controller denial of service

LOW 37

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01542 Published 2022-09-07 Fixed in 0.23.0, 0.32.0 CWE-400

TI-2022-08630 CVE-2022-24817 · GHSA-vvmq-fwmg-2gjc

Improper kubeconfig validation allows arbitrary code execution

MEDIUM 45

Flux2 is an open and extensible continuous delivery solution for Kubernetes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01118 Published 2022-05-06 Fixed in 0.29.0, 0.23.0 +1 CWE-94

Vulnerabilities

Filters

Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

Flux2 Helm Controller denial of service

Improper kubeconfig validation allows arbitrary code execution