CVE-2022-0567 Missing authorization in ovn-kubernetes
Privileged attackers can bypass ingress policies via egress rules, exposing unreachable pods to unauthorized network access and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0567?
CVE-2022-0567 is a critical missing authorization vulnerability in ovn-kubernetes, published on 20 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.
Weakness: CWE-20
Which versions are affected by CVE-2022-0567?
It affects 1 product.
Products include Ovn Ovn-Kubernetes.
How do I fix CVE-2022-0567?
No fix has been published for CVE-2022-0567 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-0567 being exploited?
There is no known exploitation of CVE-2022-0567 in the wild and no public exploit code.
Other vulnerabilities in ovn-kubernetes
Sources
Also known as GHSA-cxqq-cw7f-wv88.