Go/github.com/fluxcd/flux2 CVE-2022-24877: critical 9.9, EPSS 1.19%
Improper path handling in kustomization files allows path traversal
Action: Upgrade github.com/fluxcd/flux2 to 0.29.0 or later.
go get github.com/fluxcd/flux2@v0.29.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.29.0 | - |
Fixed versions
| 0.29.0 |
Sources
- osv: GHSA-j77r-2fxf-5jrw#Go/github.com/fluxcd/flux2
- https://github.com/fluxcd/flux2/security/advisories/GHSA-j77r-2fxf-5jrw
- https://nvd.nist.gov/vuln/detail/CVE-2022-24877
- https://github.com/fluxcd/kustomize-controller/commit/f4528fb25d611da94e491346bea056d5c5c3611f
- https://github.com/fluxcd/pkg/commit/0ec014baf417fd3879d366a45503a548b9267d2a
CVE-2022-24877 · published · modified · JSON