Detections
Analytics

SCA: security update for github.com/fluxcd/flux2 (GHSA-xwf3-6rgv-939r)

high Tenable Cloud Security Plugin ID 420712

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration (like Git
 repositories), and automating updates to configuration when there is new code to deploy. Flux CLI allows
 users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allows other
 applications to replace the Flux deployment information with arbitrary content which is deployed into the
 target Kubernetes cluster instead. The vulnerability is due to the improper handling of user-supplied
 input, which results in a path traversal that can be controlled by the attacker. Users sharing the same
 shell between other applications and the Flux CLI commands could be affected by this vulnerability. In
 some scenarios no errors may be presented, which may cause end users not to realize that something is
 amiss. A safe workaround is to execute Flux CLI in ephemeral and isolated shell environments, which can
 ensure no persistent values exist from previous processes. However, upgrading to the latest version of the
 CLI is still the recommended mitigation strategy. (CVE-2022-36035)

See Also

https://github.com/advisories/GHSA-xwf3-6rgv-939r

Plugin Details

Severity: High

ID: 420712

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-36035

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/1/2022

Vulnerability Publication Date: 8/31/2022

Reference Information

CVE: CVE-2022-36035

cwe: CWE-22