Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-24878

CVE-2022-24878: Improper path handling in Kustomization files allows for denial of service

7.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-24878
GHSA ID
GHSA-7pwf-jg34-hxwp
EPSS Score
0.5238%
CWE
CWE-674
Published
5/20/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/fluxcd/kustomize-controllergo>= 0.16.0, < 0.24.00.24.0
github.com/fluxcd/flux2go>= 0.19.0, < 0.29.00.29.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper cycle detection in Kustomization file processing. The reconciliation loop (KustomizationReconciler.reconcile) and resource loader (loader.Load) are core components that process user-provided kustomization.yaml files. The lack of cycle checks in these functions allowed recursive references to cause endless loops. The CWE-674 (Uncontrolled Recursion) alignment and the patched 'blocking references' behavior described in advisories strongly implicate these functions. The high confidence comes from the architectural role of these functions and the explicit mention of path/dependency handling fixes in the patch notes.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** kustomiz*-*ontroll*r *n**l*s t** us* o* Kustomiz*’s *un*tion*lity w**n *pplyin* Ku**rn*t*s ***l*r*tiv* st*t* onto * *lust*r. * m*li*ious us*r **n us* * sp**i*lly *r**t** `kustomiz*tion.y*ml` to **us* **ni*l o* S*rvi** *t *ontroll*r l*v*l. In mul

Reasoning

T** vuln*r**ility st*ms *rom improp*r *y*l* **t**tion in Kustomiz*tion *il* pro**ssin*. T** r**on*ili*tion loop (`Kustomiz*tionR**on*il*r.r**on*il*`) *n* r*sour** lo***r (`lo***r.Lo**`) *r* *or* *ompon*nts t**t pro**ss us*r-provi*** `kustomiz*tion.y*