Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.
References
| Link | Resource |
|---|---|
| https://www.tigera.io/security-bulletins-tta-2022-001/ | Vendor Advisory |
| https://www.tigera.io/security-bulletins-tta-2022-001/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.tigera.io/security-bulletins-tta-2022-001/ - Vendor Advisory |
14 Jun 2022, 15:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:tigera:calico_enterprise:3.12.0:*:*:*:*:*:*:* cpe:2.3:a:tigera:calico_enterprise:*:*:*:*:*:*:*:* cpe:2.3:o:tigera:calico_os:*:*:*:*:*:*:*:* |
|
| CWE | CWE-20 | |
| References | (MISC) https://www.tigera.io/security-bulletins-tta-2022-001/ - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.5
v3 : 5.5 |
06 Jun 2022, 18:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-06 18:15
Updated : 2024-11-21 06:56
NVD link : CVE-2022-28224
Mitre link : CVE-2022-28224
CVE.ORG link : CVE-2022-28224
JSON object : View
Products Affected
tigera
- calico_os
- calico_enterprise