VDB
CVE-2022-1677
CVE-2022-1677
PUBLISHED
CVSS 6.300000190734863 MEDIUM
In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.
EPSS 0.60% · 48.5th percentile
Risk Scores
CVSS 3.1
6.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.60%
48.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | openshift_container_platform | 4.8, 3.11, 4.6 |
| n/a | Openshift | 3.11 |
Timeline
- Sep 1, 2022 CVE Published
- Sep 2, 2022 EPSS Score
- Oct 18, 2022 EPSS Score
- Dec 4, 2022 EPSS Score
- Jan 19, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 22, 2023 EPSS Score
- Jun 7, 2023 EPSS Score
- Jul 24, 2023 EPSS Score
- Sep 8, 2023 EPSS Score
- Oct 25, 2023 EPSS Score
- Dec 10, 2023 EPSS Score
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2076211 url
- https://nvd.nist.gov/vuln/detail/CVE-2022-1677 advisory
- https://access.redhat.com/security/cve/CVE-2022-1677 advisory
- https://access.redhat.com/errata/RHBA-2022:1690 advisory
- https://access.redhat.com/errata/RHSA-2022:2264 advisory
- https://access.redhat.com/errata/RHSA-2022:2268 advisory
- https://access.redhat.com/errata/RHSA-2022:2272 advisory
- https://access.redhat.com/errata/RHSA-2022:2281 advisory
- https://access.redhat.com/errata/RHSA-2022:2283 advisory