Go/github.com/fluxcd/source-controller CVE-2022-39272: medium 5, EPSS 0.77%
Improper use of metav1.Duration allows for Denial of Service
Action: Upgrade github.com/fluxcd/source-controller to 0.30.0 or later.
go get github.com/fluxcd/source-controller@v0.30.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.1-alpha-1 | 0.30.0 | - |
Fixed versions
| 0.30.0 |
Sources
- osv: GHSA-f4p5-x4vc-mh4v#Go/github.com/fluxcd/source-controller
- https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v
- https://nvd.nist.gov/vuln/detail/CVE-2022-39272
- https://github.com/kubernetes/apimachinery/issues/131
- https://github.com/fluxcd/helm-controller/pull/533
- https://github.com/fluxcd/image-automation-controller/pull/439
- https://github.com/fluxcd/image-reflector-controller/pull/314
- https://github.com/fluxcd/kustomize-controller/pull/731
- https://github.com/fluxcd/notification-controller/pull/420
- https://github.com/fluxcd/source-controller/pull/903
- https://github.com/fluxcd/flux2
- https://github.com/kubernetes/apimachinery#131
- https://pkg.go.dev/vuln/GO-2022-1071
CVE-2022-39272 · published · modified · JSON