VULNERABILITY INTELLIGENCE

CVE-2022-1677

CVSS score6.3 MEDIUM

EPSS probability0.60%

CISA KEVNot currently listed

Published2022-09-01

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.

Weakness classification

secalert@redhat.com: CWE-400
nvd@nist.gov: NVD-CWE-noinfo

Primary references

secalert@redhat.com — Vendor Advisory
secalert@redhat.com — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory