BIT-kustomize-2022-24817

    Dashboard / Vulnerabilities / BIT-kustomize-2022-24817

    BIT-kustomize-2022-24817

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Improper kubeconfig validation allows arbitrary code execution

    Details: Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0

    References: https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc, https://nvd.nist.gov/vuln/detail/CVE-2022-24817

    Affected packages

    Package

    Name: kustomize

    Purl: pkg:bitnami/kustomize

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.1.0
    Fixed -0.23.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-kustomize-2022-24817 | CVE-DB