CVE-2022-39272 - CVE House
Back to Database
Status published Medium CVE-2022-39272

Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

Vulnerability Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39272

Credits & Attribution

No credits recorded in the NVD database.

References

More from fluxcd

View All →
CVE-2024-31216
source-controller leaks theAzure Storage SAS token into logs on connection errors
Medium 5.1
CVE-2022-36049
Flux2 Helm Controller denial of service
High 7.7
CVE-2022-36035
Flux CLI Workload Injection
High 7.7
CVE-2022-24878
Improper path handling in Kustomization files allows for denial of service
High 7.7
CVE-2022-24877
Improper path handling in kustomization files allows path traversal
Critical 9.9

Affected Vendor

Affected Software

flux2
Vulnerable Versions:
< 0.35.0

Timeline

Official Publish: October 21st, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Weaknesses (CWE)

CWE-1284

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.