CVE-2022-28224

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:*
cpe:2.3:a:tigera:calico_enterprise:3.12.0:*:*:*:*:*:*:*
cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:*
cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:*
cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:56

Type Values Removed Values Added
References () https://www.tigera.io/security-bulletins-tta-2022-001/ - Vendor Advisory () https://www.tigera.io/security-bulletins-tta-2022-001/ - Vendor Advisory

Information

Published : 2022-06-06 18:15

Updated : 2024-11-21 06:56


NVD link : CVE-2022-28224

Mitre link : CVE-2022-28224

CVE.ORG link : CVE-2022-28224


JSON object : View

Products Affected

tigera

  • calico_os
  • calico_enterprise
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-201

Insertion of Sensitive Information Into Sent Data

CWE-20

Improper Input Validation