CVE-2022-22975 An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-22975?
CVE-2022-22975 is a medium-severity vulnerability in Pinniped, published on 11 May 2022.
Official description
An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership.
Weakness: CWE-74
Which versions are affected by CVE-2022-22975?
1 open source package ship an affected version, including pinniped. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pinniped Bitnami | From 0.9.0 | 0.17.0 |
Products include Vmware Pinniped.
How do I fix CVE-2022-22975?
Upgrade pinniped to 0.17.0 or later.
Is CVE-2022-22975 being exploited?
There is no known exploitation of CVE-2022-22975 in the wild and no public exploit code.
Other vulnerabilities in Pinniped
Sources
Also known as BIT-pinniped-2022-22975, GHSA-hvrf-5hhv-4348.