AZL-10974
Dashboard / Vulnerabilities / AZL-10974
Summary: CVE-2022-1798 affecting package kubevirt for versions less than 0.55.1-1
Details: A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.
References: https://nvd.nist.gov/vuln/detail/CVE-2022-1798
Affected packages
Package
Name: kubevirt
Purl: pkg:rpm/azure-linux/kubevirt
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -0.55.1-1
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
