Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
CVE-2022-28224

5.5MEDIUM

Key Information:

Vendor

Tigera

Status
Calico Enterprise
Calico
Vendor
CVE Published:
1 June 2022

What is CVE-2022-28224?

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Affected Version(s)

Calico <= unspecified

Calico Enterprise <= unspecified

References

https://www.tigera.io/security-bulletins-tta-2022-001/
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.