Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
References
Link | Resource |
---|---|
https://www.tigera.io/security-bulletins-tta-2022-001/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2022-06-06 18:15
Updated : 2024-02-28 19:09
NVD link : CVE-2022-28224
Mitre link : CVE-2022-28224
CVE.ORG link : CVE-2022-28224
JSON object : View
Products Affected
tigera
- calico_enterprise
- calico_os