Skip to content
Fencer Vulns
medium 5.0

CVE-2022-39272 json

Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

published 2022-10-19 4 y ago modified 2026-09-10 1 mo ago also BIT-flux-2022-39272 , BIT-kustomize-2022-39272 , EUVD-2022-7087 , GHSA-f4p5-x4vc-mh4v , GO-2022-1071

cvss
5.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits
0
none known

Summary

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

Patch / fix

  • go github.com/fluxcd/flux2 0.35.0
  • go github.com/fluxcd/source-controller 0.30.0
  • go github.com/fluxcd/kustomize-controller 0.29.0
  • go github.com/fluxcd/helm-controller 0.24.0
  • go github.com/fluxcd/notification-controller 0.27.0
  • go github.com/fluxcd/image-automation-controller 0.26.0
  • go github.com/fluxcd/image-reflector-controller 0.22.0
  • go github.com/fluxcd/helm-controller/api 0.26.0
  • go github.com/fluxcd/image-automation-controller/api 0.26.1
  • go github.com/fluxcd/image-reflector-controller/api 0.22.1
  • go github.com/fluxcd/kustomize-controller/api 0.30.0
  • go github.com/fluxcd/notification-controller/api 0.28.0
  • go github.com/fluxcd/source-controller/api 0.30.0
  • bitnami flux 0.35.0
  • bitnami kustomize 0.29.0
  • fluxcd flux2 0.35.0
  • fluxcd helm-controller 0.24.0
  • fluxcd image-automation-controller 0.26.0
  • fluxcd image-reflector-controller 0.22.0
  • fluxcd kustomize-controller 0.29.0
  • fluxcd notification-controller 0.27.0
  • fluxcd source-controller 0.30.0
  • flux Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 0.36.0-r0

alpine advisories ALPINE-CVE-2022-39272

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
GitHub 3.1 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go github.com/fluxcd/flux2
>=0.1.0, <0.35.0
0.35.0
go github.com/fluxcd/source-controller
>=0.0.1-alpha-1, <0.30.0
0.30.0
go github.com/fluxcd/kustomize-controller
>=0.0.1-alpha-1, <0.29.0
0.29.0
go github.com/fluxcd/helm-controller
>=0.0.1-alpha-1, <0.24.0
0.24.0
go github.com/fluxcd/notification-controller
>=0.0.1-alpha-1, <0.27.0
0.27.0
go github.com/fluxcd/image-automation-controller
>=0.1.0, <0.26.0
0.26.0
go github.com/fluxcd/image-reflector-controller
>=0.1.0, <0.22.0
0.22.0
go github.com/fluxcd/helm-controller/api
<0.26.0
0.26.0
go github.com/fluxcd/image-automation-controller/api
<0.26.1
0.26.1
go github.com/fluxcd/image-reflector-controller/api
<0.22.1
0.22.1
go github.com/fluxcd/kustomize-controller/api
<0.30.0
0.30.0
go github.com/fluxcd/notification-controller/api
<0.28.0
0.28.0
go github.com/fluxcd/source-controller/api
<0.30.0
0.30.0
bitnami flux
>=0.1.0, <0.35.0
0.35.0
bitnami kustomize
>=0.0.2, <0.29.0
0.29.0

Affected products

  • fluxcd flux2

Classification

Weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.