CVE-2022-0567

· CRITICALModified

← All CVEs

CVSS v3.1

9.1

EPSS

1.00%

Published

Apr 20, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

Affected Products (4)

ovn · ovn-kubernetes (up to 4.7.47)vulnerable

ovn · ovn-kubernetes (up to 4.8.36)vulnerable

ovn · ovn-kubernetes (up to 4.9.27)vulnerable

ovn · ovn-kubernetes (up to 4.10.8)vulnerable

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=2053326

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2053326

Issue TrackingThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs