Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be
    vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged
    attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may
    allow the attacker to intercept and reroute traffic to their compromised pod. (CVE-2022-28224)

An update of the calico package has been released.

ID	Name	Product	Family	Type	Severity
421794	SCA: security update for github.com/projectcalico/calico (GHSA-9394-xfq9-6qrp)	Tenable Cloud Security	SCA Checks	Local	medium
421794	SCA: security update for github.com/projectcalico/calico (GHSA-9394-xfq9-6qrp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
204433	Photon OS 4.0: Calico PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	Local	critical
203810	Photon OS 3.0: Calico PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-28224

medium

Tenable Plugins

medium

medium

critical

critical