Skip to content
Fencer Vulns
medium 5.1

CVE-2022-3172 json

Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

published 2023-11-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-42593

cvss
5.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

Patch / fix

  • Kubernetes kube-apiserver v1.22.14, v1.23.11, v1.24.5, v1.25.1
  • kubernetes Debian 14, Debian 13, Debian 12 1.20.5+really1.20.2-1

debian advisories DEBIAN-CVE-2022-3172

  • tox openshift ironic 4.12 3.23.0-2.el9.1
  • crit openshift 4.12 3.15-4.rhaos4.11.el8
  • criu openshift 4.12 3.15-4.rhaos4.11.el8
  • crun openshift 4.12 1.4.2-1.rhaos4.11.el8
  • crun openshift 4.12 1.4.2-2.rhaos4.12.el9
  • grpc openshift 4.12 1.18.0-4.el8ost
  • runc openshift 4.12 3:1.1.2-2.rhaos4.12.el8
  • tini openshift 4.12 0.16.1-1.el8ar

red hat advisories RHSA-2022:7398RHSA-2023:1655RHBA-2022:7200

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3172 updated cvss 5.1

kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF)

  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-tests
    affected: no fix planned “Will not fix”
  • Red Hat Openshift Container Storage 4 ocs4/ocs-rhel8-operator
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.10 openshift 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7, openshift 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8, openshift-hyperkube 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7, openshift-hyperkube 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8
    fixed: vendor fix RHSA-2023:1655
  • Red Hat OpenShift Container Platform 4.11 openshift 4.11.0-202210122157.p0.g5157800.assembly.stream.el8, openshift-hyperkube 4.11.0-202210122157.p0.g5157800.assembly.stream.el8
    fixed: vendor fix RHBA-2022:7200
  • Red Hat OpenShift Container Platform 4.12 openshift 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8, openshift 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el9, openshift-hyperkube 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8, openshift-hyperkube 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el9
    fixed: vendor fix RHSA-2022:7398
  • Red Hat RHODF 4.12 for RHEL 8 odf4/ocs-rhel8-operator v4.12.4-2, odf4/odf-rhel8-operator v4.12.4-2
    fixed: vendor fix RHSA-2023:3609
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.11 openstack-ironic 20.2.1-0.20221012165024.b44ccf1.el8, openstack-ironic-api 20.2.1-0.20221012165024.b44ccf1.el8, python3-ironic-tests 20.2.1-0.20221012165024.b44ccf1.el8, openstack-ironic-common 20.2.1-0.20221012165024.b44ccf1.el8, openstack-ironic-conductor 20.2.1-0.20221012165024.b44ccf1.el8, openstack-ironic-dnsmasq-tftp-server 20.2.1-0.20221012165024.b44ccf1.el8 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.12 tox 3.23.0-2.el9.1, crudini 0.9.3-4.el9, pysnmp 4.4.12-6.el9, future 0.18.2-9.el9.1, subunit 1.4.0-6.el9.1, pyflakes 2.2.0-3.el9.1, +451 more Red Hat OpenShift Container Platform 4 openshift4/ose-openshift-apiserver-rhel9 Red Hat OpenShift Container Platform 4.10 haproxy 2.2.19-4.el8, haproxy22 2.2.19-4.el8, perf 4.18.0-305.85.1.el8_4, kernel 4.18.0-305.85.1.el8_4, bpftool 4.18.0-305.85.1.el8_4, toolbox 0.0.9-1.rhaos4.10.el8, +43 more Red Hat OpenShift Container Platform 4.11 python-kubernetes 24.2.0-2.el8, python3-kubernetes 24.2.0-2.el8, python3-kubernetes-tests 24.2.0-2.el8, cri-o 1.24.3-5.rhaos4.11.gitc4567c0.el8, openshift-kuryr 4.11.0-202210122157.p0.g93daed6.assembly.stream.el8, openshift-kuryr-cni 4.11.0-202210122157.p0.g93daed6.assembly.stream.el8, +3 more Red Hat OpenShift Container Platform 4.12 nmstate 1.3.3-1.el8, ostree 2022.2-5.el8, tini 0.16.1-1.el8ar, buildah 1.23.4-2.el8, grpc 1.18.0-4.el8ost, haproxy 2.2.24-1.el8, +234 more
    +1 more products
    Red Hat RHODF 4.12 for RHEL 8 odf4/cephcsi-rhel8 v4.12.4-2, odf4/mcg-core-rhel8 v4.12.4-3, odf4/odf-console-rhel8 v4.12.4-2, odf4/mcg-rhel8-operator v4.12.4-2, odf4/odr-rhel8-operator v4.12.4-2, odf4/mcg-operator-bundle v4.12.4-4, +15 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.46% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected products

  • Kubernetes kube-apiserver

Classification

Weakness
  • CWE-918 Server-Side Request Forgery
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.