p PatchFirst

CVE-2022-3172

CVE-2022-3172 · Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

CVSS 5.1 · Medium · EPSS 2.5% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • kubernetes

    Versions
    • v1.25.0: Affected
    • ≥ v1.24.0, ≤ v1.24.4: Affected (semver)
    • ≥ v1.23.0, ≤ v1.23.10: Affected (semver)
    • ≥ v1.22.0, ≤ v1.22.13: Affected (semver)
    • v1.25.1: Not affected
    • v1.24.5: Not affected
    • v1.23.11: Not affected
    • v1.22.14: Not affected
    • ≥ 0, ≤ v1.21.14: Affected (semver)

    No fix published

  • kubernetes Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

  • kubernetes Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

  • kubernetes Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.20.5+really1.20.2-1

    Update to 1.20.5+really1.20.2-1

Original sources

Check your server →