CVE-2022-28224

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:*
cpe:2.3:a:tigera:calico_enterprise:3.12.0:*:*:*:*:*:*:*
cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:*
cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:*
cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-06-06 18:15

Updated : 2024-02-28 19:09


NVD link : CVE-2022-28224

Mitre link : CVE-2022-28224

CVE.ORG link : CVE-2022-28224


JSON object : View

Products Affected

tigera

  • calico_enterprise
  • calico_os
CWE
CWE-20

Improper Input Validation

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-201

Insertion of Sensitive Information Into Sent Data